CVE-2024-13159: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

CVE-2024-13159 is an absolute path traversal vulnerability in Ivanti Endpoint Manager (EPM). It allows a remote unauthenticated attacker to leak sensitive information from the system. Endpoint management platforms like EPM typically hold inventory data, credentials, configuration details, and other operational secrets, so unauthorized disclosure can give attackers a foothold for further reconnaissance or lateral movement. Organizations running EPM should treat this as a priority for inventory and remediation.

Public detail is limited to the CISA summary and the CWE classification; exact affected versions, attack vectors, and impact scoring must be confirmed against the vendor advisory.

How it works

The flaw is classified as CWE-36 (Absolute Path Traversal). In this class of weakness, an application fails to properly restrict file-system paths supplied by a remote party. An attacker can supply an absolute path that points outside the intended directory or resource, causing the application to read and return the contents of files it should not expose.

According to the CISA summary, a remote unauthenticated attacker can exploit this in Ivanti Endpoint Manager (EPM) to leak sensitive information. No further exploit mechanics, payloads, or prerequisites are provided in the available facts; defenders should assume any network-reachable EPM instance that has not been updated is potentially reachable by an unauthenticated party and should verify the precise conditions in the vendor advisory.

Am I affected? How to find it in your systems

Ivanti Endpoint Manager (EPM) is typically deployed as a central management console for endpoint inventory, software distribution, and patching. It commonly runs on Windows servers inside enterprise networks and may be reachable from management subnets, VPN ranges, or, in some configurations, the internet.

• Inventory all systems running Ivanti EPM by querying asset-management databases, software inventory tools, or by searching for the product name and related services on servers.
• Identify the installed version and build of every EPM instance and compare it against the list of fixed versions published in the vendor advisory. Do not rely on version numbers not listed in that advisory.
• Determine whether the management interface is exposed to untrusted networks; absolute-path-traversal issues are often reachable via HTTP/HTTPS endpoints.
• Review web-server and application logs for unusual absolute-path requests (for example, paths beginning with drive letters or root directories) that return file contents or unexpected status codes. Because the vulnerability is unauthenticated, look for requests that do not carry valid session tokens yet still succeed in retrieving data.
• If EPM is offered as a cloud or hosted service, follow the applicable BOD 22-01 guidance referenced by CISA and confirm with the provider whether the instance has been patched.

How to remediate

The primary remediation is to apply the vendor-supplied update for Ivanti Endpoint Manager (EPM) as directed in the official advisory. CISA’s required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

• Download and install the patch or cumulative update named by Ivanti for this CVE; verify the installation succeeded and that the service restarts cleanly.
• After patching, re-inventory the version to confirm the vulnerable build is no longer present.
• As a general hardening step for path-traversal classes, ensure the application runs with the least privilege necessary, restrict the accounts under which EPM services execute, and limit the file-system locations those accounts can read.
• Review and tighten any network access controls that allow unauthenticated reachability to the EPM management interface.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls appropriate to an unauthenticated information-leak vulnerability.

• Segment the EPM server so that only trusted management hosts and jump boxes can reach its network ports; block direct access from user subnets and the internet.
• If a web application firewall or reverse proxy sits in front of EPM, enable rules that reject requests containing absolute path sequences or unexpected path characters; treat this as virtual patching and validate that legitimate EPM traffic is not broken.
• Temporarily disable any non-essential features or connectors that expose file-system access if the vendor documentation identifies them as related to the vulnerability.
• Increase logging and monitoring for the EPM host and any front-end proxies; alert on anomalous file-read patterns, large responses containing configuration or credential material, and any unauthenticated access that succeeds.
• If mitigations cannot be applied and the risk is unacceptable, follow the CISA guidance to discontinue use of the product until a patch is available.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to breaches in which sensitive configuration data, credentials, or inventory details are stolen. Known ransomware use of this CVE is not documented in the available facts, but information leakage can still enable follow-on attacks. If you suspect exposure, review EPM and network logs for signs of unauthorized access, rotate any credentials that may have been stored or cached by the product, and assess whether downstream systems were reached. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether related accounts appear in public dumps.