CVE-2024-13159

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Affected products

Ivanti Epm

Ivanti Endpoint Manager

< 2022, 2024

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

100.0% (100th percentile)

Weakness

CWE-36

NVD status

Analyzed

Published

2025-01-14

Attack patterns

CAPEC-597