CVE-2024-13158
Published: 14 January 2025
Summary
CVE-2024-13158 is a high-severity Path Traversal (CWE-22) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2024-13158 is an unbounded resource search path vulnerability affecting Ivanti EPM prior to the 2024 January-2025 Security Update and the 2022 SU6 January-2025 Security Update. The flaw, tracked under CWE-22 and CWE-426, permits a remote authenticated attacker to manipulate search paths and ultimately execute arbitrary code on the affected system.
An attacker with administrative privileges can exploit the issue over the network without user interaction to obtain remote code execution, resulting in full compromise of confidentiality, integrity, and availability as reflected in the CVSS 7.2 score.
The referenced Ivanti security advisory directs customers to apply the January 2025 updates for both the 2024 and 2022 SU6 releases to address the vulnerability.
The EPSS score for this CVE rose from a low baseline to a peak of 0.3920 before settling at the current value of 0.2696, indicating that exploitation interest increased after public disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51384
Vulnerability details
An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote authenticated admin code execution via untrusted search path/path traversal directly enables exploitation of public-facing app and DLL/search-order hijacking for arbitrary code load/execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unbounded resource search path vulnerability by requiring timely application of Ivanti's January-2025 security updates.
Enforces least privilege for administrative accounts, minimizing the attack surface and impact of remote authenticated exploitation requiring admin privileges.
Validates inputs to file paths and search operations, mitigating path traversal and untrusted search path exploitation leading to remote code execution.