PoC exploit for Ivanti Endpoint Manager vulnerabilities released (CVE-2024-13159)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-10811 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated… | 7.5 | 4% | PoC | |
CVE-2024-13159+2 related CVEs | Unauthenticated Absolute Path Traversal Info Leak in Ivanti Endpoint Manager (EPM) | 7.5 | 100% | KEVPoC | KEV |
From the original article
1 min read at helpnetsecurity.com
A proof-of-concept (PoC) exploit for four critical Ivanti Endpoint Manager vulnerabilities has been released by Horizon3. ai researchers. The vulnerabilities – CVE-2024-10811, CVE-2024-13161, CVE-2024-13160 and CVE-2024-13159 – may be exploited by remote, unauthenticated attackers to leverage Ivanti EPM machine account credentials for relay attacks and, ultimately, to compromise the Ivanti EPM server.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.