PT-2020-13670 · Ivanti+1 · Ivanti Endpoint Manager+1

Andrei Constantin Scutariu + 2 · Published 2020-11-12 · Updated 2020-11-24 · CVE-2020-13771

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2020.1.1

Description The issue allows for code execution and elevation of privileges to the level of privilege held by the vulnerable component, such as NT AUTHORITYSYSTEM, via DLL hijacking under certain conditions. This is due to various components relying on Windows search order when loading a nonexistent library file. The affected components include ldiscn32.exe, IpmiRedirectionService.exe, LDAPWhoAmI.exe, and ldprofile.exe.

Recommendations For Ivanti Endpoint Manager versions prior to 2020.1.1, update to version 2020.1.1 or later to resolve the issue.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2020-13771

Affected Products

Ivanti Endpoint Manager

Windows

References · 4

• https://osv.dev/vulnerability/CVE-2020-13771 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13771 · Security Note
• https://labs.jumpsec.com/advisory-cve-2020-13771-ivanti-uem-dll-hijacking · Note
• https://t.me/cybersecuritytechnologies/2098 · Telegram Post