CVE-2024-13160
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Description
CVE-2024-13160 is a critical absolute path traversal vulnerability in Ivanti Endpoint Manager (EPM) that enables remote unauthenticated attackers to read arbitrary files and exfiltrate sensitive information from the EPM server. This flaw, closely related to CVE-2024-13161 and CVE-2024-13159, stems from insufficient path validation in the EPM management interface. Rated 9.8 on CVSS v3.1 with CRITICAL severity, the vulnerability can be exploited without any credentials or user interaction over the network. CISA has added CVE-2024-13160 to the KEV catalog with a remediation deadline of 2025-03-31, and its EPSS score of 93.53% at the 99.8th percentile signals near-certain exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager | < 2022; 2022; 2024 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13160(US Government Resource)
- https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/(Exploit, Third Party Advisory)
Weakness Type
CWE-36: Absolute Path Traversal
CVE-2024-13160 is classified under CWE-36 (Absolute Path Traversal), which occurs when user-supplied input containing absolute file paths is used to access files without proper validation. In Ivanti Endpoint Manager, the application fails to validate or restrict file path parameters, allowing a remote attacker to specify arbitrary absolute paths and read any file accessible to the web application process.
Learn more: CWE-36 — Absolute Path Traversal
Impact Analysis
The impact of CVE-2024-13160 is critical and mirrors that of the related CVE-2024-13161 and CVE-2024-13159. The vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), no authentication (PR:N), and no user interaction (UI:N). Confidentiality (High): The path traversal allows reading arbitrary files from the EPM server, exposing database credentials, encryption keys, agent communication secrets, and comprehensive endpoint inventory data. Integrity (High): Stolen credentials from the EPM server can be used to push malicious configurations or software to all managed endpoints. Availability (High): Disruption of the EPM infrastructure affects patch management, software distribution, and security policy enforcement across the enterprise. With a CVSS score of 9.8 (CRITICAL) and an EPSS score of 93.53% at the 99.8th percentile, this vulnerability is being exploited at scale by threat actors targeting enterprise management infrastructure.
Exploit Maturity
CVE-2024-13160 demonstrates very high exploit maturity as part of the Ivanti EPM path traversal vulnerability cluster. CISA has confirmed active exploitation by adding it to the KEV catalog, and the EPSS score of 93.53% at the 99.8th percentile indicates near-certain exploitation, ranking in the top 0.2% of all tracked vulnerabilities. Public exploit research is available via Horizon3.ai, which details the credential coercion techniques applicable to all three related Ivanti EPM CVEs. The ransomware association is classified as unknown. The availability of detailed technical analysis and the trivial exploitation requirements (no authentication, network-accessible, low complexity) make this vulnerability a prime target for automated scanning and exploitation by a wide range of threat actors.
Remediation
-
Apply the January 2025 Security Update for Ivanti EPM. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The fix is included in the 2024 January-2025 Security Update and the 2022 SU6 January-2025 Security Update per the Ivanti Security Advisory.
-
Isolate the EPM management interface behind a VPN or jump host, ensuring it is not accessible from untrusted networks. Implement network segmentation to limit which systems can communicate with the EPM server.
-
Conduct a thorough forensic investigation to determine if the vulnerability was exploited before patching. Review web server access logs for path traversal patterns, check for unauthorized credential usage, and examine managed endpoints for signs of compromise through stolen EPM credentials.
-
Rotate all credentials that may have been exposed, including database connection strings, service account passwords, LDAP credentials, and agent deployment keys. Assume that any credential stored on or accessible through the EPM server has been compromised if the system was running a vulnerable version.
-
Deploy monitoring for credential coercion attacks by configuring alerts for unusual authentication patterns from the EPM server's IP address, unexpected SMB or LDAP traffic from the EPM server, and failed authentication attempts using EPM service accounts.
Technical Details
CVE-2024-13160 is an absolute path traversal vulnerability (CWE-36) in Ivanti Endpoint Manager with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Similar to CVE-2024-13161 and CVE-2024-13159, this vulnerability exists in a different endpoint or parameter within the EPM management interface that processes file path inputs without proper validation. The attack follows the same pattern: an unauthenticated attacker sends HTTP requests with manipulated file path parameters that traverse beyond the intended directory scope to access arbitrary files on the server. The credential coercion technique documented by Horizon3.ai applies to this CVE as well, enabling the attacker to force the EPM server into authenticating against external resources and capturing credential material. The identical CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and score of 9.8 reflect the same critical risk profile. Affected versions include Ivanti EPM prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update, with the fix implementing proper path validation and canonicalization.
Frequently Asked Questions
Is CVE-2024-13160 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2024-13160. The EPSS score of 93.53% at the 99.8th percentile indicates near-certain exploitation. This vulnerability is part of a cluster of three related Ivanti EPM path traversal flaws all under active exploitation.
What products are affected by CVE-2024-13160?
Ivanti Endpoint Manager versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update are vulnerable. Both EPM 2024 and EPM 2022 installations require the January 2025 patch.
How do I fix CVE-2024-13160?
Apply the January 2025 Security Update from Ivanti. Isolate the EPM management interface, rotate all service account credentials, and conduct a forensic investigation for compromise indicators including unauthorized file access and credential abuse.
How severe is CVE-2024-13160?
CVE-2024-13160 has a CVSS score of 9.8 (CRITICAL) allowing unauthenticated remote attackers to read arbitrary files from the EPM server. The vulnerability enables credential coercion and is actively exploited at scale.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.