CVE-2022-36975

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can...

CVE-2022-36975

CVE-2022-36975 affects Ivanti Avalanche 6.3.2.3490. The root cause is a SQL injection in the ProfileDaoImpl class triggered by a crafted request that builds SQL from user-supplied strings, enabling authentication bypass. This is documented across multiple sources (ZDI advisory ZDI-22-780 and ZDI-...