CVE-2024-13159 is an absolute path traversal vulnerability in Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. This flaw allows an unauthenticated remote attacker to leak sensitive information. With a CVSS score of 7.5 (HIGH) and an EPSS score indicating high exploitability, it poses a significant risk due to its low attack complexity and severe impact on confidentiality. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog. While no Metasploit or ExploitDB modules are available, Nuclei templates exist, and it has garnered substantial community discussion and media coverage, including reports of credential coercion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2022CPE matchmatch criteria | cpe:2.3:a:ivanti:endpoint_manager:*:-:*:*:*:*:*:* | ||
2022CPE matchmatch criteria | cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:* | ||
2022CPE matchmatch criteria | cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:* | ||
2022CPE matchmatch criteria | cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:* | ||
2022CPE matchmatch criteria | cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.