CVE-2020-13771 Privilege escalation in n/a
Attackers can achieve code execution and privilege escalation via DLL hijacking in Ivanti Endpoint Manager components due to insecure library loading.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-13771?
CVE-2020-13771 is a high-severity vulnerability in Ivanti Endpoint Manager, published on 12 Nov 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a (nonexistent) library file, allowing (under certain conditions) one to gain code execution (and elevation of privileges to the level of privilege held by the vulnerable component such as NT AUTHORITY\SYSTEM) via DLL hijacking. This affects ldiscn32.exe, IpmiRedirectionService.exe, LDAPWhoAmI.exe, and ldprofile.exe.
Weakness: CWE-427
Which versions are affected by CVE-2020-13771?
It affects 1 product.
Products include Ivanti Endpoint Manager.
How do I fix CVE-2020-13771?
No fix has been published for CVE-2020-13771 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-13771 being exploited?
There is no known exploitation of CVE-2020-13771 in the wild and no public exploit code.
Other vulnerabilities in Ivanti Endpoint Manager
- CVE-2024-13159 Ivanti Endpoint Manager (EPM) Absolute Path Traversal
- CVE-2024-13160 Ivanti Endpoint Manager (EPM) Absolute Path Traversal
- CVE-2024-13161 Ivanti Endpoint Manager (EPM) Absolute Path Traversal
- CVE-2024-29824 Ivanti Endpoint Manager (EPM) SQL Injection
- CVE-2026-1603 Ivanti Endpoint Manager (EPM) Authentication Bypass
Sources
Also known as GHSA-r87r-jqj3-5jg8.