CVE-2024-13161: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

CVE-2024-13161 is an absolute path traversal vulnerability in Ivanti Endpoint Manager (EPM). It allows a remote unauthenticated attacker to leak sensitive information from affected systems. Endpoint management platforms like EPM typically hold inventory data, configuration details, and credentials used across the enterprise, so information disclosure here can give attackers a foothold for further reconnaissance or lateral movement. Confirm all product-specific details against the vendor advisory before acting.

How it works

The weakness is classified as CWE-36 (Absolute Path Traversal). In this class of flaw, an application fails to properly restrict file or path references supplied by a remote party. An attacker can supply crafted input that resolves to absolute filesystem locations outside the intended directory, causing the application to return or expose content that should remain inaccessible. According to the CISA summary, the result in Ivanti EPM is leakage of sensitive information without requiring authentication. Exact request formats, parameters, or file targets are not provided here; treat any public proof-of-concept claims with caution and validate them only against the official vendor advisory and your own lab testing.

Am I affected? How to find it in your systems

Ivanti Endpoint Manager is commonly deployed as a central management server that communicates with agents on endpoints for software distribution, inventory, and patching. It may run on-premises or in hybrid/cloud-managed configurations. Inventory steps:

• Query asset-management or CMDB records for hosts running Ivanti EPM (or related Ivanti management components).
• Scan internal networks for the management console ports and services typically associated with EPM; confirm the product version and build against the list of affected releases published by Ivanti.
• Review configuration files and installation directories for the presence of the EPM server software.
• Check authentication and access logs on the EPM console for unexpected unauthenticated requests that reference file paths or unusual resource identifiers.
• If you use cloud-hosted or managed EPM instances, follow the applicable BOD 22-01 guidance referenced by CISA and confirm status with your Ivanti support channel.

Because the vulnerability is remote and unauthenticated, any internet-exposed or poorly segmented EPM instance should be treated as higher priority. Specific version ranges and fixed builds must be confirmed against the vendor advisory; do not rely on secondary sources alone.

How to remediate

Patch first. Apply the vendor-supplied update or mitigation for Ivanti Endpoint Manager exactly as described in the official advisory. After patching:

• Restart affected services only if the vendor instructions require it, then verify the new version string.
• Re-scan the management server with a vulnerability scanner that has a signature for CVE-2024-13161 once the signature is available.
• Harden the installation by ensuring the EPM console is reachable only from trusted administrative networks, enforcing least-privilege service accounts, and removing any unnecessary file-system permissions granted to the EPM process.
• If the product is no longer supported or mitigations cannot be applied, CISA guidance states that organizations should discontinue use of the product.

Document the change window and retain evidence of the applied update for audit purposes.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Segment the EPM server so that only authorized management workstations and required agents can reach it; block direct internet access entirely.
• Place a web application firewall or reverse proxy in front of the console and enable rules that reject path-traversal patterns (absolute paths, encoded directory separators, and unexpected file extensions). Virtual patching is temporary; it is not a substitute for the official fix.
• Disable any non-essential remote management features or file-related APIs if the product configuration allows it without breaking core operations.
• Increase logging verbosity for the EPM console and forward logs to a SIEM; alert on unauthenticated requests that contain path-like strings or that return unusually large or sensitive-looking responses.
• Monitor for subsequent anomalous activity from the EPM host itself, such as unexpected outbound connections or privilege escalations, which could indicate successful information abuse.

These measures lower risk but do not eliminate the underlying vulnerability; schedule the permanent patch as soon as operationally feasible.

If your data may have been exposed

Actively exploited information-disclosure flaws can lead to broader compromise once attackers obtain credentials, configuration files, or network maps. Known ransomware use of this specific CVE is not documented, yet the sensitive data potentially leaked by EPM remains valuable. If you suspect exposure, review EPM logs for signs of unauthorized access, rotate any credentials that may have been stored or cached by the product, and examine related systems for follow-on activity. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether related accounts have appeared in prior incidents.