CVE-2020-13774: ivanti endpoint manager

csirt@kutim:~/threat-intel/cve/CVE-2020-13774

CVSS 9.9 · Critical EPSS 5,0%

Kerentanan Unrestricted Upload of File with Dangerous Type pada ivanti endpoint manager. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations on the uploaded image, which upon failure will leave the temporarily created files in an accessible location on the server.

Rincian

Terbit di NVD: 12 November 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 5,0% peluang dieksploitasi; lebih tinggi dari 91,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
ivanti	endpoint manager	Versi 2019.1
ivanti	endpoint manager	Versi 2020.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://labs.jumpsec.com/advisory-cve-2020-13774-ivanti-uem-rce/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.