CVE-2024-13159

CVE Database · CVE-2024-13159

CVE-2024-13159

· CRITICALAnalyzed

CVSS v3.1

9.8

EPSS

99.76%

Published

Jan 14, 2025

Modified

Oct 24, 2025

CISA Known Exploited Vulnerability

Added: 2025-03-10 · Due: 2025-03-31

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public PoC / Exploit (3)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index GitHub PoChorizon3ai/Ivanti-EPM-Coercion-Vulnerabilities★13

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-36

Affected Products (9)

ivanti · endpoint_manager (up to 2022)vulnerable

ivanti · endpoint_managervulnerable

References (3)

https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13159

US Government Resource

https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs