CVE-2024-13159

CRITICAL CISA KEV

Published Jan 14, 2025 Modified Oct 24, 2025 CWE-36

Description

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild.

Added: Mar 10, 2025 Remediation due: Mar 31, 2025

Weakness Type (CWE)

CWE-36 CWE-36

Affected Products

Vendor	Product	Versions
ivanti	endpoint_manager	< 2022
ivanti	endpoint_manager	All
ivanti	endpoint_manager	All
ivanti	endpoint_manager	All
ivanti	endpoint_manager	All
ivanti	endpoint_manager	All
ivanti	endpoint_manager	All
ivanti	endpoint_manager	All
ivanti	endpoint_manager	All

References

Frequently Asked Questions

What is CVE-2024-13159? +

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. It has a CVSS v3.1 base score of 9.8 (CRITICAL). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.

How severe is CVE-2024-13159? +

CVE-2024-13159 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-13159? +

CVE-2024-13159 affects products from ivanti, specifically: endpoint_manager. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-13159? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-46822

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path …

CVE-2024-51549 10.0

Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series …

CVE-2024-9924 9.8

The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote …

CVE-2025-34392 9.8

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined …

CVE-2024-20401 9.8

A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote …

CVE-2024-13161 9.8

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a …