HIGH
CVE-2024-13160
CVSS
7.5
KEV
Description
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Summary dbcve.org
Absolute path traversal vulnerability in Ivanti EPM allows remote unauthenticated attackers to access files on the underlying system by manipulating file path references, potentially exposing sensitive configuration or system files.
Mitigation
Apply the January-2025 Security Update for Ivanti EPM 2024 and the January-2025 Security Update for Ivanti EPM 2022 SU6 to remediate this vulnerability.
Weakness (CWE)
CWE-36
EPSS Score
91.25%
Probability of exploitation in next 30 days
99.8th percentile
References
https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13160
US Government Resource
https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
Exploit, Third Party Advisory
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.