PT-2020-13671 · Ivanti · Ivanti Endpoint Manager

Andrei Constantin Scutariu + 2 · Published 2020-11-16 · Updated 2020-11-21 · CVE-2020-13772

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions through 2020.1.1

Description The issue allows an attacker to disclose information about the server operating system, local pathnames, and environment variables with no authentication required. This is possible through the /ldclient/ldprov.cgi endpoint.

Recommendations For Ivanti Endpoint Manager versions through 2020.1.1, consider restricting access to the /ldclient/ldprov.cgi endpoint until a patch is available. As a temporary workaround, limit the information disclosed by the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-13772

Affected Products

Ivanti Endpoint Manager

References · 7

• 🔥 https://labs.jumpsec.com/cve-2020-13772-ivanti-uem-system-information-disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13772 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13772 · Vendor Advisory
• https://forums.ivanti.com/s · Vendor Advisory
• https://t.me/cvenotify/5620 · Telegram Post
• https://t.me/cibsecurity/16351 · Telegram Post
• https://t.me/cvenotify/5964 · Telegram Post