Arbitrary file upload in Ivanti Endpoint Manager
CVE-2020-13774
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations on the uploaded image, which upon failure will leave the temporarily created files in an accessible location on the server.
Vulnerability class: Unrestricted File Upload
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.050 (91.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 91.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.050 · newest: 0.050 · change: 0.000
Affected products
- Ivanti Endpoint Manager — versions 2019.1, 2020.1
Weakness classification (CWE)
References
- labs.jumpsec.com/advisory-cve-2020-13774-ivanti-uem-rce/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-13774?
- CVE-2020-13774 is a critical-severity vulnerability in Ivanti Endpoint Manager, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.9/10. Published 2020-11-12.
- How severe is CVE-2020-13774?
- Critical severity. CVSS v3 base score is 9.9 out of 10.