PT-2020-13679 · Ivanti · Ivanti Dsm Netinst

Published 2020-08-06 · Updated 2020-08-11 · CVE-2020-13793

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti DSM netinst version 5.1

Description The issue concerns the unsafe storage of Active Directory credentials due to a static, hard-coded encryption key. This affects the security of the credentials stored within Ivanti DSM netinst.

Recommendations For Ivanti DSM netinst version 5.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-13793

Affected Products

Ivanti Dsm Netinst

References · 5

• https://forums.ivanti.com/s/article/Release-Notes-for-DSM-2020-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13793 · Security Note
• https://insinuator.net/2020/06/security-advisories-for-ivanti-dsm-suite · Note
• https://t.me/cibsecurity/13949 · Telegram Post