CVE-2024-10811
Published: 14 January 2025
Summary
CVE-2024-10811 is a critical-severity Absolute Path Traversal (CWE-36) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Forced Authentication (T1187); ranked in the top 9.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-10811 is an absolute path traversal vulnerability, also referenced under CWE-36 and CWE-22, that affects Ivanti Endpoint Manager (EPM) prior to the 2024 January-2025 Security Update and the 2022 SU6 January-2025 Security Update. The flaw carries a CVSS 3.1 base score of 9.8 and permits remote, unauthenticated access that can result in disclosure of sensitive information.
A remote attacker with no credentials or user interaction can send crafted requests over the network to traverse absolute paths and retrieve restricted files or data from the affected EPM installation. The published description limits the direct outcome to information leakage, although the CVSS vector indicates potential high impact across confidentiality, integrity, and availability.
Ivanti’s January 2025 security advisory directs customers to apply the listed EPM updates for both the 2024 and 2022 SU6 branches. The associated EPSS score rose from a low baseline to a peak of 0.1564 on 2025-12-11 before receding to the current value of 0.0619, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33593
Vulnerability details
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Absolute path traversal vulnerability allows unauthenticated remote attackers to supply UNC paths, coercing the Ivanti EPM server machine account to authenticate via SMB to attacker-controlled shares, enabling NTLM credential capture and relay attacks.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely application of Ivanti's January-2025 security updates to remediate the path traversal flaw.
Prevents absolute path traversal exploitation by validating and sanitizing user-supplied path inputs to restrict access to authorized directories.
Enforces logical access restrictions on sensitive files and resources, limiting the impact of any successful path traversal attempts.