CVE-2020-13774: ivanti endpoint_manager
Vulnerability summary
CVE-2020-13774 is a critical (CVSS 9.9) vulnerability in ivanti endpoint_manager. EPSS estimates a 4.95% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities.
Timeline
- 12-11-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations on the uploaded image, which upon failure will leave the temporarily created files in an accessible location on the server.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
4.95%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.95% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ivanti1 product
- endpoint_manager2019.1 | 2020.1
1 vendor · 1 product