CVE-2024-13159: critical vulnerability in Ivanti Endpoint Manager
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A security flaw in Ivanti EPM allows attackers to access sensitive files on the server by using specially crafted requests that bypass protections. This can expose confidential information without requiring any authentication.
Absolute path traversal vulnerability in Ivanti EPM (CWE-36) permits remote, unauthenticated attackers to read arbitrary files from the server filesystem by manipulating file path parameters. The vulnerability affects versions before January-2025 Security Update; exploitation requires no authentication or user interaction, resulting in unauthorized information disclosure.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.