CVE-2024-13159
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Description
CVE-2024-13159 is a critical absolute path traversal vulnerability in Ivanti Endpoint Manager (EPM) that allows unauthenticated remote attackers to access and exfiltrate sensitive files from the server. Part of a cluster of related path traversal flaws in Ivanti EPM (alongside CVE-2024-13160 and CVE-2024-13161), this vulnerability exploits inadequate input validation in file path handling. With a CVSS v3.1 score of 9.8 and CRITICAL severity, no authentication, user interaction, or special conditions are required for exploitation. CISA has confirmed active exploitation by adding CVE-2024-13159 to the KEV catalog with a deadline of 2025-03-31, and its EPSS score of 93.98% at the 99.9th percentile places it in the top 0.2% of all vulnerabilities by exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager | < 2022; 2022; 2024 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13159(US Government Resource)
- https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/(Exploit, Third Party Advisory)
Weakness Type
CWE-36: Absolute Path Traversal
CVE-2024-13159 is classified under CWE-36 (Absolute Path Traversal), which occurs when user-supplied input containing absolute file paths is used to access files without proper validation. In Ivanti Endpoint Manager, the application fails to validate or restrict file path parameters, allowing a remote attacker to specify arbitrary absolute paths and read any file accessible to the web application process.
Learn more: CWE-36 — Absolute Path Traversal
Impact Analysis
The impact of CVE-2024-13159 is critical, completing a trio of path traversal vulnerabilities in Ivanti EPM alongside CVE-2024-13160 and CVE-2024-13161. The vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N). Confidentiality (High): Arbitrary file read on the EPM server exposes credentials, configuration data, managed device inventories, and sensitive enterprise data. Integrity (High): Compromised credentials enable unauthorized modifications to endpoint configurations, software deployments, and security policies. Availability (High): Complete compromise of the EPM server disrupts centralized management capabilities. With a CVSS score of 9.8 (CRITICAL) and an EPSS score of 93.98% at the 99.9th percentile, this vulnerability ranks in the top 0.2% by exploitation probability, reflecting widespread and sustained attack campaigns.
Exploit Maturity
CVE-2024-13159 exhibits very high exploit maturity, completing the trio of critical Ivanti EPM path traversal vulnerabilities under active exploitation. CISA has confirmed active exploitation by including it in the KEV catalog, and the EPSS score of 93.98% at the 99.9th percentile ranks it in the top 0.2% of all vulnerabilities globally. Public exploit research is available via Horizon3.ai, providing comprehensive technical details on the credential coercion attack methodology. The ransomware association is classified as unknown. Given Ivanti products' history as high-value targets for nation-state actors and ransomware groups, organizations should assume that exploitation is widespread and prioritize immediate remediation.
Remediation
-
Apply the January 2025 Security Update for Ivanti EPM without delay. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The patch is available in both the 2024 January-2025 Security Update and the 2022 SU6 January-2025 Security Update as detailed in the Ivanti Security Advisory.
-
Implement network access controls restricting access to the EPM management interface to authorized administrators only. Deploy firewall rules, VPN requirements, or zero-trust network access controls to prevent unauthorized network access.
-
Perform comprehensive credential rotation for all accounts associated with the EPM infrastructure, including database accounts, directory service accounts, agent communication secrets, and administrative accounts. This is critical due to the credential coercion attack chain documented by Horizon3.ai.
-
Investigate for prior exploitation by analyzing web server logs, network traffic captures, and endpoint telemetry for indicators of path traversal attacks, unauthorized file access, and credential abuse originating from or targeting the EPM server.
-
Establish ongoing vulnerability management for Ivanti products, which have been frequent targets for exploitation. Subscribe to Ivanti security advisories, implement a rapid patching process for critical updates, and consider deploying additional monitoring around all Ivanti infrastructure components.
Technical Details
CVE-2024-13159 is an absolute path traversal vulnerability (CWE-36) in Ivanti Endpoint Manager with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vulnerability, the third in a cluster of related path traversal flaws (alongside CVE-2024-13160 and CVE-2024-13161), affects yet another endpoint in the EPM management interface where file path parameters are processed without adequate sanitization. The attack methodology mirrors the other two CVEs: an unauthenticated attacker sends crafted HTTP requests that exploit the path traversal to read arbitrary files from the EPM server or coerce the server into authenticating against attacker-controlled resources. The Horizon3.ai research demonstrates that all three vulnerabilities share the same underlying code pattern of accepting user-controlled file paths and passing them to file system APIs without canonicalization or boundary checking. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maximum score of 9.8 confirm the trivially exploitable nature and critical impact of this vulnerability on enterprise endpoint management infrastructure.
Frequently Asked Questions
Is CVE-2024-13159 being actively exploited?
Yes, CISA has confirmed active exploitation by including CVE-2024-13159 in the KEV catalog. With an EPSS score of 93.98% at the 99.9th percentile, it ranks in the top 0.2% of all vulnerabilities by exploitation probability.
What products are affected by CVE-2024-13159?
Ivanti Endpoint Manager versions before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update are affected. This is one of three related path traversal CVEs (alongside CVE-2024-13160 and CVE-2024-13161) that all require the same patch.
How do I fix CVE-2024-13159?
Apply the January 2025 Security Update from Ivanti, which addresses all three related path traversal vulnerabilities. Implement network access controls, rotate all EPM credentials, and investigate for prior exploitation.
How severe is CVE-2024-13159?
CVE-2024-13159 has a CVSS score of 9.8 (CRITICAL) and allows unauthenticated remote file read and credential coercion. The near-certain exploitation probability and critical severity make immediate patching essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.