CVE-2024-13161 | Vulnetix

CVE-2024-13161 PUBLISHED CVSS 9.8 CRITICAL

Reported by ivanti · Published January 14, 2025

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
endpoint_manager	ivanti	2022

Risk scores

CVSS 3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
Ivanti	Endpoint Manager	2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update
Ivanti	Endpoint Manager	*

Timeline

Jan 14, 2025 CVE Published
Jan 14, 2025 PoC Published (58 in total, the first dated here)
Jan 15, 2025 EPSS Score (30 in total, the first dated here)
Feb 18, 2025 VulnCheck XDB Entry
Feb 19, 2025 Nuclei Template
Feb 19, 2025 Fix Commit
Feb 25, 2025 Coalition ESS Score (24 in total, the first dated here)
Mar 10, 2025 CISA KEV Added
Mar 10, 2025 VulnCheck KEV Exploitation (357 in total, the first dated here)
Jun 2, 2026 Security Advisory
Jun 17, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2024-13161
vulnetix vdb fixes CVE-2024-13161

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-13161/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →