What is the severity of CVE-2024-13161?

CVE-2024-13161 is rated as a high-severity vulnerability that allows remote unauthenticated attackers to exploit sensitive information.

How do I fix CVE-2024-13161?

To mitigate CVE-2024-13161, users should upgrade to the January-2024 Security Update or the January-2025 Security Update for Ivanti EPM.

What type of attack does CVE-2024-13161 involve?

CVE-2024-13161 involves an absolute path traversal attack which can lead to information leakage.

Who is affected by CVE-2024-13161?

CVE-2024-13161 affects users of Ivanti Endpoint Manager versions prior to the January-2024 and January-2025 Security Updates.

Can CVE-2024-13161 be exploited remotely?

Yes, CVE-2024-13161 can be exploited remotely by unauthenticated attackers.

Vulnerability/
CVE-2024-13161

Exploited

critical

9.8

CWE

22 36

14/1/2025

21/2/2025

CVE-2024-13161: Path Traversal

First published: Tue Jan 14 2025(Updated: )

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Credit: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Affected Software	Affected Version	How to fix
Ivanti Endpoint Manager (EPM)	<2024 January-2025 Security Update<2022 SU6 January-2025 Security Update

Never miss a vulnerability like this again

Reference Links

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

What is the severity of CVE-2024-13161?
CVE-2024-13161 is rated as a high-severity vulnerability that allows remote unauthenticated attackers to exploit sensitive information.
How do I fix CVE-2024-13161?
To mitigate CVE-2024-13161, users should upgrade to the January-2024 Security Update or the January-2025 Security Update for Ivanti EPM.
What type of attack does CVE-2024-13161 involve?
CVE-2024-13161 involves an absolute path traversal attack which can lead to information leakage.
Who is affected by CVE-2024-13161?
CVE-2024-13161 affects users of Ivanti Endpoint Manager versions prior to the January-2024 and January-2025 Security Updates.
Can CVE-2024-13161 be exploited remotely?
Yes, CVE-2024-13161 can be exploited remotely by unauthenticated attackers.

agent/weakness
agent/first-publish-date
agent/description
agent/type
agent/author
agent/guess-ai
agent/software-canonical-lookup
agent/softwarecombine
collector/the-register
source/The Register
alias/CVE-2024-10811
alias/CVE-2024-13161
alias/CVE-2024-13160
alias/CVE-2024-13159
agent/references
agent/source
agent/trending
agent/news-ai
exploited/true
agent/severity
agent/tags
agent/event
collector/mitre-cve
source/MITRE
agent/last-modified-date
collector/nvd-api
source/NVD
vendor/ivanti
canonical/ivanti endpoint manager (epm)

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.