Medium severity · published Nov 16, 2020
CVE-2020-13772
In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and…
5.3
CVSS
2.3%
EPSS
No
On KEV
Description
In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Endpoint Manager · Ivanti
through 2020.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13772
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13772
Permissions Required
https://forums.ivanti.com/s/
Exploit
https://labs.jumpsec.com/cve-2020-13772-ivanti-uem-system-information-disclosure/
More from Endpoint Manager
8.8
CVE-2024-29824
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
7.5
CVE-2026-1603
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
7.5
CVE-2024-13159
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
7.5
CVE-2024-13160
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
7.5
CVE-2024-13161
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability