CVE-2024-13160: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

Absolute path traversal vulnerability (CVE-2024-13160) affects Ivanti Endpoint Manager (EPM) versions before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. The vulnerability allows remote unauthenticated attackers to leak sensitive information (MITRE CVE, CISA KEV).

The vulnerability exists in the WSVulnerabilityCore.dll component, specifically in the GetHashForWildcard() method within the LANDesk.ManagementSuite.WSVulnerabilityCore namespace. The function constructs a path based on user input without proper validation, allowing an attacker to specify a remote UNC path. This vulnerability is tracked as CWE-36 (Absolute Path Traversal) (Horizon3 Research).

When successfully exploited, the vulnerability allows remote unauthenticated attackers to leak sensitive information from the system. The vulnerability can be used as part of a credential coercion attack, potentially allowing attackers to relay authentication attempts and compromise the server (Horizon3 Research).

Organizations should immediately apply the January-2025 Security Update for EPM 2024 and EPM 2022 SU6. CISA has set a remediation date of March 31, 2025, for federal agencies to address this vulnerability (CISA KEV, Ivanti Forums).