CVE-2020-13769

HIGH

Ivanti Endpoint Manager < 2020.1 - SQL Injection via /remotecontrolauth/api/device Request

Title source: llm

LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request.

Core 2

Core References

Permissions Required, Vendor Advisory x_refsource_misc

Exploit, Third Party Advisory x_refsource_misc

CVSS v3 8.8

EPSS 0.0584

EPSS Percentile 90.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89

Status published

Products (1)

ivanti/endpoint_manager < 2020.1

Published Nov 16, 2020

Tracked Since Feb 18, 2026