Actively exploited in the wild
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Ivanti - Endpoint Manager (EPM) · Listed in the CISA KEV since 2025-03-10. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-13159
CriticalCVSS 9.8KEVSummary
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Risk Assessment
An unauthenticated attacker can access sensitive files on the server, potentially leading to data leakage and security breach. This could be used for further attacks.
Recommendation
Immediately apply the January 2025 security update for Ivanti EPM (versions 2024 and 2022 SU6). Additionally, restrict network access to the EPM server.
Other vulnerabilities in Ivanti EPM
See all- CVE-2024-13161CriticalActively exploited
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- CVE-2024-13160CriticalActively exploited
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Original NVD description (English source)
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.