Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

CISA has flagged this as exploited in the wild and proof-of-concept code is available. Patches are available and immediate patching is recommended.

Proof-of-concept code is now available for these vulnerabilities. Patches are available and immediate patching is recommended.

Ivanti Endpoint Manager (EPM) versions before the 2024 January-2025 Security Update and 2022 SU6 Juanuary-2025 Security Update suffer from an absolute path traversal vulnerability, allowing a remonte and unauthenticatd attack to leak sensitive information.

The version of Ivanti Endpoint Manager 2022 SU6 running on the remote host lacking the January 2022 SU6 Hotfix. It is, therefore, affected by mutliple vulnerabilities: 

  - Absolute path traversal in Ivanti Endpoint Manager before 2022 SU6 January Security Update or 2022 SU6 November     Security Update allows a remote unauthenticated attacker to achieve code execution. User interaction     is not required. (CVE-2024-10811, CVE-2024-13159, CVE-2024-13160, CVE-2024-13161)

  - Improper Validation and Deserialization of untrusted data in Ivanti Endpoint Manager before 2022 SU6     November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker     to achieve remote code execution. User interaction is required.     (CVE-2024-13163, CVE-2024-13170, CVE-2024-13171)   
  - An out-of-bounds read in Ivanti Endpoint Manager before 2022 SU6 November Security Update or 2022 SU6 November     Security Update allows allows a local authenticated attacker to escalate their privileges.      (CVE-2024-13169)

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number of the affected dll files.

The version of Ivanti Endpoint Manager 2024 running on the remote host lacking the January 2024 Hotfix. It is, therefore, affected by mutliple vulnerabilities: 

  - Absolute path traversal in Ivanti Endpoint Manager before 2024 January Security Update or 2022 SU6 November     Security Update allows a remote unauthenticated attacker to achieve code execution. User interaction     is not required. (CVE-2024-10811, CVE-2024-13159, CVE-2024-13160, CVE-2024-13161)

  - Improper Validation and Deserialization of untrusted data in Ivanti Endpoint Manager before 2024     November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker     to achieve remote code execution. User interaction is required.     (CVE-2024-13163, CVE-2024-13170, CVE-2024-13171)   
  - An out-of-bounds read in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November     Security Update allows allows a local authenticated attacker to escalate their privileges.      (CVE-2024-13169)

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number of the affected dll files.

ID	Name	Product	Family	Severity
114689	Ivanti EPM Credentials Coercion	Web App Scanning	Component Vulnerability	high
214343	Ivanti Endpoint Manager 2022 SU6 - January 2025 Security Update	Nessus	Windows	high
214342	Ivanti Endpoint Manager 2024 - January 2025 Security Update	Nessus	Windows	high

Detections

Analytics

CVE-2024-13161

high

Tenable Plugins

high

high

high