cve/2024/CVE-2024-13161.md

CVE-2024-13161

Description

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

POC

Reference

• https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/cyb3r-w0lf/nuclei-template-collection
• https://github.com/cyberdyne-ventures/predictions
• https://github.com/hogehuga/cveTreage
• https://github.com/opendr-io/causality
• https://github.com/packetinside/CISA_BOT
• https://github.com/ums91/CISA_BOT