Security readout for executives and security teams
Plain-English summary
CVE-2020-13772 lets an unauthenticated attacker obtain system information from Ivanti Endpoint Manager servers through 2020.1.1. The disclosed details include operating system information, local paths, and environment variables. This is not described as remote code execution, but it can reduce attacker effort for follow-on intrusion planning.
Executive priority
Prioritize remediation for internet-facing or widely reachable Ivanti Endpoint Manager deployments. The issue discloses reconnaissance-grade system data without authentication, which can help attackers prepare later attacks, but the provided evidence does not show active exploitation or direct system compromise.
Technical view
The issue is an unauthenticated information disclosure in /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1. Public sources describe exposure of server operating system details, filesystem pathnames, and environment variables. The bundle provides no CVSS score, CWE, fixed version, or vendor mitigation detail.
Likely exposure
Exposure is most relevant where Ivanti Endpoint Manager web components are reachable by untrusted users, especially internet-facing management portals or broadly accessible internal networks. The source bundle does not provide CPEs or detailed affected build metadata beyond through 2020.1.1.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation. A public research reference exists, so defenders should assume the behavior is publicly known without treating exploitation as confirmed.
Researcher notes
Key evidence is sparse: the CVE description identifies the endpoint and disclosed data types, while the bundle lacks scoring, CWE, affected CPEs, and fix details. Treat version and exposure validation as the first task before assigning emergency remediation status.
Mitigation direction
- Review Ivanti guidance for fixed versions or supported configuration changes.
- Restrict access to Ivanti Endpoint Manager web endpoints to trusted networks.
- Block unauthenticated external access to /ldclient/ldprov.cgi where operationally possible.
- Monitor web logs for suspicious unauthenticated requests to the affected endpoint.
- Review exposed environment data and rotate any secrets found there.
Validation and detection
- Inventory Ivanti Endpoint Manager servers and identify versions through 2020.1.1.
- Confirm whether the affected CGI endpoint is reachable from untrusted networks.
- Review historical web logs for unauthenticated access to /ldclient/ldprov.cgi.
- During authorized testing, verify whether responses expose OS, paths, or environment data.
- Document compensating controls if immediate upgrade guidance is unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-13772 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://forums.ivanti.com/s/CVE reference · x_refsource_MISC
- https://labs.jumpsec.com/cve-2020-13772-ivanti-uem-system-information-disclosure/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.