{"id":"CVE-2021-22962","published":"2023-12-19T15:43:26Z","modified":"2024-08-03T18:58:26Z","title":"An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a…","vendor":"Ivanti","product":"Avalanche","tier":"core","eol":null,"affectedVersions":[{"vendor":"Ivanti","product":"Avalanche","versions":[">= 6.4.1, <= 6.4.1"]}],"description":{"text":"An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.","provenance":"source","from":"CVE.org"},"summary":{"text":"Ivanti Avalanche contains a flaw in its request handling that can be triggered by specially crafted requests. The vulnerability requires no authentication or user interaction, and an attacker with network access to the Avalanche component can send such a request to leak sensitive data or cause a resource-based denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:35Z"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.91,"percentile":0.99807,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-10087","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10087","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-12-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-22962","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9981"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.11,"detail":"base score 7.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}