CVE-2024-13158
Published: 14 January 2025
Summary
CVE-2024-13158 is a high-severity Path Traversal (CWE-22) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the unbounded resource search path vulnerability by requiring timely application of Ivanti's January-2025 security updates.
Enforces least privilege for administrative accounts, minimizing the attack surface and impact of remote authenticated exploitation requiring admin privileges.
Validates inputs to file paths and search operations, mitigating path traversal and untrusted search path exploitation leading to remote code execution.
NVD Description
An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Deeper analysisAI
CVE-2024-13158 is an unbounded resource search path vulnerability affecting Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. This flaw, linked to CWE-22 (Path Traversal) and CWE-426 (Untrusted Search Path), enables a remote authenticated attacker with administrative privileges to execute arbitrary code on the targeted system. The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high-impact potential despite requiring elevated privileges.
Exploitation requires network access and administrative authentication, allowing the attacker to leverage the unbounded search path to load and execute malicious code remotely. Successful exploitation grants high confidentiality, integrity, and availability impacts, potentially leading to full system compromise within the EPM environment.
Ivanti's security advisory recommends applying the January-2025 Security Updates for EPM 2024 and EPM 2022 SU6 to mitigate the vulnerability. Additional details are available in the official advisory at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6.
Details
- CWE(s)