CVE-2024-13161
Published: 14 January 2025
Description
Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.
Security Summary
CVE-2024-13161 is an absolute path traversal vulnerability (CWE-36) affecting Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. It enables a remote unauthenticated attacker to leak sensitive information from the affected system. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with network accessibility, low complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability.
A remote unauthenticated attacker can exploit this vulnerability over the network without privileges to traverse directories and access sensitive files, resulting in information disclosure. The high integrity and availability impact scores suggest potential for broader disruption beyond leakage, though the primary effect is unauthorized access to sensitive data.
Ivanti's security advisory recommends applying the January-2025 Security Updates for EPM 2024 and EPM 2022 SU6 to mitigate the issue. The vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild.
Additional research from Horizon3.ai highlights related credential coercion vulnerabilities in Ivanti Endpoint Manager, underscoring the need for comprehensive patching in this product line.
Details
- CWE(s)
- KEV Date Added
- 10 March 2025
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Absolute path traversal vulnerability in Ivanti EPM allows unauthenticated remote attackers to coerce machine account NTLM authentication to attacker-controlled UNC/SMB shares, enabling Forced Authentication (T1187) for potential relay attacks.