CVE-2024-13159

CVE-2024-13159 is an absolute path traversal vulnerability (CWE-36) in Ivanti Endpoint Manager (EPM) that allows a remote, unauthenticated attacker to leak sensitive information from the server. It is triggered when the EPM server processes attacker-supplied requests containing absolute file-system paths without properly constraining them, letting the attacker retrieve files outside the intended directory. A successful attack discloses arbitrary file contents, which could include configuration or credential material useful for further compromise; the available data describes information disclosure only, not code execution. Any organization running an Ivanti EPM management server, particularly one reachable by untrusted networks, is affected, though the source data does not specify affected version ranges. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-10, indicating confirmed in-the-wild exploitation, and EPSS assigns it a 100% probability of exploitation within 30 days; no public proof-of-concept is known.

What to do: Apply the fixed updates identified in Ivanti's security advisory (specific patched versions are not included in the available data), and follow CISA KEV required action: apply vendor mitigations, comply with BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Until patched, restrict network access to the EPM management server to trusted networks and review HTTP/server logs for requests referencing absolute file paths that could indicate exploitation.