HIGH
CVE-2024-13161
CVSS
7.5
KEV
Description
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Summary dbcve.org
Absolute path traversal vulnerability in Ivanti Endpoint Policy Manager allows a remote unauthenticated attacker to access sensitive files by supplying absolute file paths in HTTP requests, potentially exposing system files, credentials, or configuration data outside the intended web root.
Mitigation
Apply the January-2025 Security Update for the respective version (2024 or 2022 SU6) to remediate this vulnerability. If immediate patching is not possible, restrict external access to the EPM management interface via network segmentation or firewall rules.
Weakness (CWE)
CWE-36
EPSS Score
90.08%
Probability of exploitation in next 30 days
99.8th percentile
References
https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13161
US Government Resource
https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
Exploit, Third Party Advisory
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.