IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
9.8Kritisch KEV

CVE-2024-13159Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti Endpoint Manager Veröffentlicht: (vor 1 Jahr)

Bekannt ausgenutzt — Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

CISA hat am 10.03.2025 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 31.03.2025.

Erforderliche Maßnahme: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-13159

Beschreibung

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Schwachstellentyp (CWE): CWE-36

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Ivanti Endpoint Manager fixed 2024 January-2025 Security Update, fixed 2022 SU6 January-2025 Security Update

Referenzen und Patches

CPE-Treffer (NVD) (9)
  • cpe:2.3:a:ivanti:endpoint_manager:*:-:*:*:*:*:*:* < 2022
  • cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:endpoint_manager:2022:su6:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*

Neue CVEs im selben Produkt — Ivanti (Connect Secure, EPMM…)

9.9Kritisch
CVE-2026-109412
Ivanti Neurons Patch for Intune

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

7.7Hoch
CVE-2026-106047
Ivanti Xtraction

A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.

7.5Hoch
CVE-2026-106043
Ivanti Xtraction

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.

9.9Kritisch
CVE-2026-106042
Ivanti Xtraction

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmi…

5.5Mittel
CVE-2026-106035
Ivanti Xtraction

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.