HIGH
CVE-2024-13159
CVSS
7.5
KEV
Description
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Summary dbcve.org
This is an absolute path traversal vulnerability in Ivanti Endpoint Manager (EPM) that allows remote unauthenticated attackers to access sensitive files on the underlying filesystem by specifying absolute paths in HTTP requests, bypassing normal directory restrictions.
Mitigation
Apply the January-2025 Security Update for EPM 2024 and the January-2025 Security Update for EPM 2022 SU6. If immediate patching is not possible, restrict network access to EPM management interfaces and monitor for suspicious requests containing absolute file paths.
Weakness (CWE)
CWE-36
EPSS Score
99.99%
Probability of exploitation in next 30 days
100th percentile
References
https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13159
US Government Resource
https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
Exploit, Third Party Advisory
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.