CVE-2024-13158

CVE-2024-13158 is an unbounded resource search path vulnerability affecting Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. This flaw, linked to CWE-22 (Path Traversal) and CWE-426 (Untrusted Search Path), enables a remote authenticated attacker with administrative privileges to execute arbitrary code on the targeted system. The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high-impact potential despite requiring elevated privileges.

Exploitation requires network access and administrative authentication, allowing the attacker to leverage the unbounded search path to load and execute malicious code remotely. Successful exploitation grants high confidentiality, integrity, and availability impacts, potentially leading to full system compromise within the EPM environment.

Ivanti's security advisory recommends applying the January-2025 Security Updates for EPM 2024 and EPM 2022 SU6 to mitigate the vulnerability. Additional details are available in the official advisory at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6.