CVE-2024-10811

PoC —

CVSS 3.1

7.5 high

EPSS

4%p89

Published

Jan 14, 2025 (Jan 14, 2025)

Modified

Jun 17, 2026

Description

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Vendors: ivanti
Products: endpoint manager
Weakness: CWE-36, CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (3.6%)

In the news3 stories

PoC exploit for Ivanti Endpoint Manager vulnerabilities released (CVE-2024-13159)

Help Net SecurityFeb 24, 00:00 UTC · Feb 24, 2025Exploit / PoC in the wildCVE-2024-13159 CVE-2024-10811 CVE-2024-13161+1 CVEs

Researcher Uncovers Critical Flaws in Multiple Versions of Ivanti Endpoint Manager

The Hacker NewsFeb 20, 10:44 UTC · Feb 20, 2025Exploit / PoC in the wildCVE-2024-10811 CVE-2024-13161 CVE-2024-13160+3 CVEs

⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [20 January]

The Hacker NewsJan 20, 12:04 UTC · Jan 20, 2025Ransomware CVE-2025-21333 CVE-2025-21334 CVE-2025-21335+36 CVEs