CVE-2024-13160: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

CVE-2024-13160 is an absolute path traversal vulnerability in Ivanti Endpoint Manager (EPM). It allows a remote unauthenticated attacker to leak sensitive information from the system. Endpoint management platforms like EPM sit at the center of device inventory, software deployment, and configuration control, so information disclosure here can give attackers useful details for further targeting of the environment. Confirm all product details and fixes against the vendor advisory.

How it works

The underlying weakness is CWE-36, absolute path traversal. In this class of flaw, an application fails to properly constrain file-system paths supplied by a user. An attacker can craft a request that references an absolute path outside the intended directory, causing the application to read and return file contents it should never expose.

According to the CISA summary, a remote unauthenticated attacker can exploit this in Ivanti EPM to leak sensitive information. No further exploit mechanics, request formats, or specific file targets are provided in the available facts; treat any public proof-of-concept claims with caution and validate them only against official vendor guidance. The practical result is unauthorized disclosure of data that the EPM process can access, which may include configuration files, credentials, or other operational details.

Am I affected? How to find it in your systems

Ivanti Endpoint Manager is typically deployed as a central management server (or set of servers) used by IT and security teams to inventory, patch, and configure endpoints. It often runs on Windows servers inside the corporate network or in hybrid/cloud-managed setups and is reachable by management consoles, agents, and sometimes remote administration interfaces.

• Inventory all systems running Ivanti EPM by checking software inventories, CMDB records, and listening services associated with the product.
• Identify the exact version and build of every EPM instance; compare those versions against the fixed releases listed in the vendor advisory. Do not rely on version numbers from third-party sources.
• Review network exposure: determine whether the EPM management interfaces are reachable from untrusted networks or the internet.
• Examine application and web-server logs for unusual path-like strings in request parameters or URLs that attempt to reference absolute paths (for example, drive letters or root-level directories). Look for anomalous file-read activity originating from the EPM process.
• If EPM agents are present on endpoints, note their communication patterns with the core server; unexpected data exfiltration or large file transfers may warrant investigation.

Public detail on exact vulnerable configurations is limited; always confirm against the official Ivanti advisory.

How to remediate

The primary remediation is to apply the vendor-supplied update for Ivanti Endpoint Manager as directed in the official advisory. Follow the CISA required action: apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for any cloud-hosted components, or discontinue use of the product if mitigations are unavailable.

• Schedule and test the patch in a non-production environment first, then deploy to production EPM servers.
• After patching, re-verify the version and confirm that the vulnerable path-handling behavior is no longer present.
• As hardening for this class of issue, ensure the EPM service account runs with least privilege, restrict the directories it can access, and keep the underlying operating system and web components fully updated.
• Review and tighten authentication and network access controls around the management interfaces even after the patch is applied.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls appropriate to absolute path traversal and unauthenticated information disclosure:

• Segment the EPM servers so they are reachable only from trusted management networks; block direct internet access.
• Place a web application firewall or reverse proxy in front of any HTTP(S) interfaces and apply virtual-patch rules that reject requests containing absolute path sequences or suspicious file references. Validate any such rules against the vendor’s guidance.
• Disable or restrict any non-essential remote management features or APIs that are not required for daily operations.
• Increase monitoring: alert on anomalous file-access patterns by the EPM process, unexpected outbound connections, and high-volume data transfers.
• If the risk cannot be adequately mitigated, consider temporarily taking the affected service offline or discontinuing use until a patch is available, consistent with CISA’s direction.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to breaches in which sensitive configuration or operational data is stolen. If you suspect your EPM instance was targeted, treat any information the service could access as potentially compromised, rotate credentials, and investigate for follow-on activity. You can run a free exposure scan of your email addresses to check whether they appear in known breach data sets.