High 3 exploited CVEs WID-SEC-2025-0072 17 CVEs

Ivanti Endpoint Manager: Mehrere Schwachstellen

Published Jan 14, 2025 · Updated Mar 10, 2025 · Revision 3 · de-DE

Vendor: ivanti Product: Endpoint Manager Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager ausnutzen, um seine Privilegien zu erweitern, Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen und Informationen offenzulegen.

Product

Ivanti Endpoint Manager ist eine Endpoint Management Software zur zentralen Verwaltung von Benutzerprofilen und -Geräten.

Vulnerabilities 17

Critical 9.8

CVE-2024-13159 Exploited Public exploit Scanner template EPSS 100%

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security U…

ivanti Endpoint Manager Network devices

Jan 14, 2025
KEV Mar 10, 2025
Critical 9.8

CVE-2024-13160 Exploited Scanner template EPSS 91%

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security U…

ivanti Endpoint Manager Network devices

Jan 14, 2025
KEV Mar 10, 2025
Critical 9.8

CVE-2024-13161 Exploited Scanner template EPSS 90%

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security U…

ivanti Endpoint Manager Network devices

Jan 14, 2025
KEV Mar 10, 2025
Critical 9.8

CVE-2024-10811

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security U…

ivanti Endpoint Manager Network devices

Jan 14, 2025
Critical 9.1

CVE-2024-32848 EPSS 43%

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …

ivanti EPM Network devices

Sep 12, 2024
High 7.8

CVE-2024-13163

Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 …

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.8

CVE-2024-13164

An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.8

CVE-2024-13169

An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Upd…

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.8

CVE-2024-13171 EPSS 18%

Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 S…

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.8

CVE-2024-13172

Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Se…

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.5

CVE-2024-13165

An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up…

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.5

CVE-2024-13166

An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up…

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.5

CVE-2024-13167

An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up…

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.5

CVE-2024-13168

An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up…

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.5

CVE-2024-13170

An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up…

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.2

CVE-2024-13158

An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 …

ivanti Endpoint Manager Network devices

Jan 14, 2025
High 7.2

CVE-2024-13162 EPSS 65%

SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allo…

ivanti Endpoint Manager Network devices

Jan 14, 2025

Revision history

2025-03-10 #3
Aktive Ausnutzung gemeldet
2025-02-20 #2
PoC aufgenommen
2025-01-14 #1
Initiale Fassung

References

Ivanti Security Advisory vom 2025-01-14
https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US