Latest Articles

Advisory CVE-2020-13769 – Ivanti Unified Endpoint Manager SQL injection

Software: Ivanti Endpoint Manager Affected Versions: <= 2020.1; <= 2019.1.3 Vendor page: www.ivanti.com CVE Reference: CVE-2020-13769 Published: 13/11/2020 CVSS 3.1 Score: 7.4 - AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L Attack Vector: Remote, authenticated Credits: Andrei Constantin Scutariu, Lenk Ratchakrit, Calvin Yau Summary A number of web components in Endpoint Manager do not properly sanitize user input when executing SQL queries, leaving the application vulnerable to injection attacks towards the underlying database. On a standard installation with default options, the account used to query the database is database administrator.

Read more →

November 13, 2020,Andrei Constantin Scutariu

Advisory CVE-2020-13772 - Ivanti Unified Endpoint Manager system information disclosure

Software: Ivanti Endpoint Manager Affected Versions: <= 2020.1.1 Vendor page: www.ivanti.com CVE Reference: CVE-2020-13772 Published: 13/11/2020 CVSS 3.1 Score: 5.3 - AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector: Remote, unauthenticated Credits: Andrei Constantin Scutariu, Lenk Ratchakrit, Calvin Yau Summary Ivanti Unified Endpoint Manager’s “ldcient” component expose information about the system that could be used in further attacks against the system. Mitigation There is currently no fix for this issue. The vendor has yet to release a patch to address the vulnerability; it is advised to review the host configuration and monitor for suspicious activity. If possible, consider disabling or whitelisting access to the affected URLs.

Read more →

November 13, 2020,Andrei Constantin Scutariu

Advisory CVE-2020-13773 - Ivanti Unified Endpoint Manager Reflected XSS

Software: Ivanti Endpoint Manager Affected Versions: <= 2020.1.1 Vendor page: www.ivanti.com CVE Reference: CVE-2020-13773 Published: 13/11/2020 CVSS 3.1 Score: 5.5 - AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Attack Vector: Remote, authenticated Credits: Andrei Constantin Scutariu, Lenk Ratchakrit, Calvin Yau Summary Various web pages on Ivanti Unified Endpoint Manager web management console lack proper input validation on parameters passed in HTTP request, leaving the application vulnerable to client-side attacks. An attacker able to cause the victim to open a malicious URL would obtain javascript code execution on the victim’s browser and potentially be able to obtain sensitive information and execute actions on their behalf.

Read more →

November 13, 2020,Andrei Constantin Scutariu