CVE-2024-13159

Published Jan 14, 2025

Last updated 19 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-13159 is a credential coercion vulnerability found in Ivanti Endpoint Manager (EPM). It exists within the `GetHashForWildcardRecursive()` method of the `VulCore` class, located in the `WSVulnerabilityCore.dll` file. This method improperly validates user-supplied input, specifically the "wildcard" parameter. This oversight allows attackers to manipulate the wildcard parameter to construct a remote UNC path. Consequently, the EPM server is tricked into reading files from an attacker-specified directory. This vulnerability, along with three others (CVE-2024-10811, CVE-2024-13160, and CVE-2024-13161), can be exploited by unauthenticated attackers to potentially compromise the EPM server. Proof-of-concept exploit code has been publicly released, increasing the risk of attacks. These vulnerabilities were patched by Ivanti in January 2025. Users of affected EPM versions are strongly encouraged to apply the necessary updates.

Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Exploit added on: Mar 10, 2025
Exploit action due: Mar 31, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

3c1d8aa1-5a33-4ea4-8992-aadd6440af75: CWE-36

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:*:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "11BA6FEC-4862-4799-B8A1-9CEF9FE1B147",
            "versionEndExcluding": "2022"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "46580865-5177-4E55-BDAC-73DA4B472B35"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E57E12B5-B789-450C-9476-6C4C151E6993"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E47C65B3-56DD-4D65-8B4B-6AFFE28E94F2"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "10D6EAB7-B14B-45E9-92B9-4FADFBBB08AF"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1877FB55-76BA-4714-ABB8-47258132F537"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4F9E8D45-5F12-4D45-A74E-C314FA3618A3"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5BB1FEE4-8B72-42A4-A7E1-DB3B10CE5CEE"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6C7283FE-C10A-4E37-B004-15FB0CAC49A5"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]