CVE-2020-13772

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions through 2020.1.1

Description The issue allows an attacker to disclose information about the server operating system, local pathnames, and environment variables with no authentication required. This is possible through the /ldclient/ldprov.cgi endpoint.

Recommendations For Ivanti Endpoint Manager versions through 2020.1.1, consider restricting access to the /ldclient/ldprov.cgi endpoint until a patch is available. As a temporary workaround, limit the information disclosed by the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.