#VU102838 Path traversal in Endpoint Manager - CVE-2024-13158

Vulnerability identifier: #VU102838

Vulnerability risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-13158

CWE-ID: CWE-22

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Endpoint Manager
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Ivanti

Description

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to input validation error when processing directory traversal sequences within the MyResolveEventHandler method. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.

Successful exploitation of the vulnerability may lead to privilege escalation.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Endpoint Manager: before 2022

---

External links
https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US
https://www.zerodayinitiative.com/advisories/ZDI-25-031/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.