CVE-2024-13161

Description

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2024-13161
• https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-51387
• https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6