Absolute Path Traversal in Ivanti Endpoint Manager (EPM) (CVE‑2024‑13161) Enables Remote Data Leakage
What It Is — Ivanti Endpoint Manager (EPM) suffers an absolute path traversal flaw (CVE‑2024‑13161) that lets a remote, unauthenticated attacker request arbitrary files from the server’s filesystem.
Exploitability — The vulnerability is exploitable over the network without credentials; proof‑of‑concept code is publicly available. CVSS v3.1 base score is 7.8 (High).
Affected Products — Ivanti Endpoint Manager (EPM) versions prior to the vendor‑released patch (see Ivanti advisory).
Why It Matters for Trust & Control Assurance
- Control‑objective gap: Lack of robust input validation and file‑system isolation violates the “prevent unauthorized data exposure” objective that underpins many frameworks (e.g., NIST CSF Protect).
- Audit readiness: Demonstrating timely patching and remediation evidence is essential for a defensible audit trail and continuous‑monitoring programs.
- Enterprise buyer expectations: Buyers increasingly request proof that endpoint‑management tools are free of known disclosure flaws and that remediation is documented in a trusted evidence repository.
Recommended Actions
- Deploy Ivanti’s security patch for CVE‑2024‑13161 without delay.
- Verify that input‑validation controls (e.g., whitelist of allowed paths) are enforced and documented.
- Update your control‑evidence repository to capture patch‑deployment logs and validation test results.
- Run a targeted scan of all EPM instances to confirm the vulnerability is fully remediated.
Source: CISA KEV – CVE‑2024‑13161