cbcvebase.
CVE-2019-12377
published 2019-06-03

CVE-2019-12377: A vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 allows arbitrary…

PriorityP265critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
5.54%
91.8th percentile
A vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 allows arbitrary file upload, which may lead to arbitrary remote code execution.

Affected

1 ranges
VendorProductVersion rangeFixed in
ivantilandesk_management_suite——

Detection & IOCsextracted from sources · hover to see the quote

urlupl/async_upload.asp↗
  • →Monitor for unexpected or unauthenticated POST requests to the upl/async_upload.asp endpoint, especially those uploading executable or script files, which may indicate exploitation of CVE-2019-12377. ↗
  • →Alert on file creation events in web-accessible directories of Ivanti LDMS/Endpoint Manager servers following requests to upl/async_upload.asp, as successful exploitation results in arbitrary remote code execution. ↗
  • ·The vulnerability is confirmed in version 10.0.1.168 Service Update 5; detections should be scoped to Ivanti LANDESK Management Suite (LDMS / Endpoint Manager) deployments running this specific version. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.