// For flags

CVE-2024-13161

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

Yes
*KEV

Decision

Act
*SSVC
Descriptions

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Act
Exploitation
Active
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2025-01-07 CVE Reserved
  • 2025-01-14 CVE Published
  • 2025-02-20 First Exploit
  • 2025-03-10 CVE Updated
  • 2025-03-10 Exploited in Wild
  • 2025-03-31 KEV Due Date
  • 2025-06-13 EPSS Updated
CWE
  • CWE-36: Absolute Path Traversal
CAPEC
  • CAPEC-597: Absolute Path Traversal
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ivanti
Search vendor "Ivanti"
 Endpoint Manager
Search vendor "Ivanti" for product "Endpoint Manager"
*-
Affected