CVE-2024-13159

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-01-14

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Affected Platforms (CPE)

📦

Ivanti

Endpoint Manager

< 2022= 2022= 2024

References & Advisories

🔗 https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13159

🔗 https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/

Vulnerability Description

Affected Platforms (CPE)

Endpoint Manager

References & Advisories

相關漏洞威脅