CVE DatabaseCVE-2024-13159

Updated 2026-06-17한국어 권고문 →

CVE-2024-131597.5/HIGHCISA KEVCWE-36

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (CVE-2024-13159) Security Advisory

⚡ Jump to Patch

Affected Vendors

ivanti

Affected Components

endpoint manager, epm

Published Date

2025-01-14

CVSS v3.1

7.5

HIGH

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Ivanti EPM 2024 prior to the January 2025 Security Update, and EPM 2022 SU6 prior to the January 2025 Security Update

Impact

A remote unauthenticated attacker can exploit an absolute path traversal vulnerability to leak highly sensitive system information and credentials

Mitigation

Immediately apply the official Ivanti January 2025 Security Update and restrict access to the EPM management console

Affected Products & Version Scope

Ivanti EPM 2024 (prior to January 2025 Security Update) and Ivanti EPM 2022 SU6 (prior to January 2025 Security Update)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official security updates provided by Ivanti for EPM 2024 and EPM 2022 SU6. You can verify the current installation version using the following PowerShell command:

powershell

# Check the installed Ivanti EPM version via Registry
Get-ItemProperty -Path 'HKLM:\SOFTWARE\LANDesk\ManagementSuite' | Select-Object -Property Version, ProductPath

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict access to the EPM web console using IIS IP Security restrictions to allow only trusted administrative subnets.

powershell

# Restrict IIS access to trusted IP ranges only
Import-Module WebAdministration
Set-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name 'allowUnlisted' -Value $false -PSPath 'IIS:\sites\Default Web Site'
Add-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name '.' -Value @{ipAddress='10.0.0.0';subnetMask='255.0.0.0';allowed='true'} -PSPath 'IIS:\sites\Default Web Site'

3. Log Audit & IoC Verification Commands

Scan IIS log files for suspicious patterns indicating path traversal attempts or UNC path coercion.

bash

# Search IIS logs for absolute paths, backslashes, or drive letters in requests
grep -E -i '(\\.\\./|\\\\|[a-zA-Z]:)' /cygdrive/c/inetpub/logs/LogFiles/W3SVC1/*.log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

This vulnerability is actively exploited in the wild; immediately apply the Ivanti January 2025 Security Update to secure your endpoints.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-13159) is an absolute path traversal flaw (CWE-36) residing in Ivanti Endpoint Manager (EPM). The root cause is the application's failure to properly sanitize and validate user-supplied file path inputs. This allows an attacker to bypass directory restrictions and reference arbitrary files on the system.

2. Exploitation Mechanics & Attack Scenario

A remote, unauthenticated attacker can craft malicious HTTP requests containing absolute file paths or UNC paths directed at vulnerable EPM endpoints. When combined with credential coercion techniques, this vulnerability enables the attacker to force the system to leak sensitive configuration files, local system data, or network-level authentication hashes. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.

3. Infrastructure & Business Impact

Since Ivanti EPM is utilized for centralized endpoint management across enterprise networks, compromise of this platform is critical. Successful exploitation allows attackers to harvest credentials, facilitate lateral movement, and potentially gain full administrative control over the entire managed network infrastructure, leading to severe data breaches and operational disruption.

Official Vendor Advisories & References

NVD Original English Description

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13159

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Exploit, Third Party Advisory

Frequently Asked SecOps Questions (CVE-2024-13159)

FAQ

Q1. How critical is CVE-2024-13159 and is it actively exploited in the wild?

CVE-2024-13159 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2024-13159?

Primary impacted vendors include ivanti across endpoint manager, epm. Scope summary: Ivanti EPM 2024 (prior to January 2025 Security Update) and Ivanti EPM 2022 SU6 (prior to January 2025 Security Update)

Q3. What temporary mitigations or workarounds exist for CVE-2024-13159 before patching?

[Mitigation] Immediately apply the official Ivanti January 2025 Security Update and restrict access to the EPM management console Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION