cve/2024/CVE-2024-13159.md

CVE-2024-13159

Description

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

POC

Reference

• https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/Ostorlab/KEV
• https://github.com/cyb3r-w0lf/nuclei-template-collection
• https://github.com/cyberdyne-ventures/predictions
• https://github.com/hogehuga/cveTreage
• https://github.com/horizon3ai/Ivanti-EPM-Coercion-Vulnerabilities
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/opendr-io/causality
• https://github.com/packetinside/CISA_BOT
• https://github.com/plzheheplztrying/cve_monitor
• https://github.com/ums91/CISA_BOT