8
CVE-2025-13661
- EPSS 1.33%
- Veröffentlicht 09.12.2025 16:17:36
- Zuletzt bearbeitet 07.10.2026 20:10:01
- Erkennungen
Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ivanti ≫ Endpoint Manager Version < 2024
Ivanti ≫ Endpoint Manager Version 2024 Update -
Ivanti ≫ Endpoint Manager Version 2024 Update su1
Ivanti ≫ Endpoint Manager Version 2024 Update su2
Ivanti ≫ Endpoint Manager Version 2024 Update su3
Ivanti ≫ Endpoint Manager Version 2024 Update su3_security_release_1
Ivanti ≫ Endpoint Manager Version 2024 Update su4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.33% | 0.684 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8 | 2.1 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
|
| 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 | 7.1 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024