CVE-2020-13773

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-11-16 · updated 2026-06-17
Weakness: CWE-79

Description

Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDMS/alert_log.aspx, /LDMS/ServerList.aspx, /LDMS/frm_coremainfrm.aspx, /LDMS/frm_findfrm.aspx, /LDMS/frm_taskfrm.aspx, and /LDMS/query_browsecomp.aspx.

Affected products

Ivanti Endpoint Manager: through 2020.1.1

References

https://forums.ivanti.com/s/
https://labs.jumpsec.com/cve-2020-13773-ivanti-uem-reflected-xss/
https://forums.ivanti.com/s/
https://labs.jumpsec.com/cve-2020-13773-ivanti-uem-reflected-xss/

Get alerted when CVE-2020-13773 or the next vulnerability affects your stack