9.8

CVE-2024-13159

Warnung
Exploit
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ivanti ≫ Endpoint Manager Update- Version < 2022
Ivanti ≫ Endpoint Manager Version2022 Update-
Ivanti ≫ Endpoint Manager Version2022 Updatesu1
Ivanti ≫ Endpoint Manager Version2022 Updatesu2
Ivanti ≫ Endpoint Manager Version2022 Updatesu3
Ivanti ≫ Endpoint Manager Version2022 Updatesu4
Ivanti ≫ Endpoint Manager Version2022 Updatesu5
Ivanti ≫ Endpoint Manager Version2022 Updatesu6
Ivanti ≫ Endpoint Manager Version2024 Update-

10.03.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Schwachstelle

Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 93.91% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3c1d8aa1-5a33-4ea4-8992-aadd6440af75 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-36 Absolute Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.