Ivanti Endpoint Manager Security Update Advisory
Overview
We have released a security update to address a vulnerability in Ivanti Endpoint Manager. affected product users are advised to update to the latest version.
Affected Products
CVE-2024-10811, CVE-2024-13158, CVE-2024-13159, CVE-2024-13160, CVE-2024-13161, CVE-2024-13162, CVE-2024-13163, CVE-2024-13164, CVE-2024-13165, CVE-2024-13166, CVE-2024-13167, CVE-2024-13168, CVE-2024-13169, CVE-2024-13171, CVE-2024-13172
Ivanti Endpoint Manager version: ~ 2024 November security update (included)
Ivanti Endpoint Manager version: ~ 2022 SU6 November security update (included)
Resolved Vulnerabilities
Absolute path traversal vulnerability that could allow an unauthenticated attacker to exfiltrate sensitive information (CVE-2024-10811)
unbounded resource search path vulnerability that could allow remote code execution by an authenticated attacker with administrative privileges (CVE-2024-13158)
absolute path traversal vulnerability that could allow an unauthenticated attacker to exfiltrate sensitive information (CVE-2024-13159)
absolute path traversal vulnerability that could allow an unauthenticated attacker to exfiltrate sensitive information (CVE-2024-13160)
absolute path traversal vulnerability that could allow an unauthenticated attacker to exfiltrate sensitive information (CVE-2024-13161)
sQL injection vulnerability that could allow remote code execution by an authenticated attacker with administrative privileges (CVE-2024-13162)
data deserialization vulnerability that could allow remote code execution by an unauthenticated attacker (CVE-2024-13163)
uninitialized resource vulnerability that could allow a locally authenticated attacker to escalate privileges (CVE-2024-13164)
out-of-bounds write vulnerability that could allow an unauthenticated attacker to cause a denial of service condition (CVE-2024-13165)
out-of-bounds write vulnerability that could allow an unauthenticated attacker to cause a denial of service condition (CVE-2024-13166)
out-of-bounds write vulnerability that could allow an unauthenticated attacker to cause a denial of service condition (CVE-2024-13167)
out-of-bounds write vulnerability that could allow an unauthenticated attacker to cause a denial of service condition (CVE-2024-13168)
out-of-bounds read vulnerability that could allow an authenticated attacker to escalate privileges (CVE-2024-13169)
out-of-bounds write vulnerability that could allow an unauthenticated attacker to cause a denial of service condition (CVe-2024-13170)
filename under-validation vulnerability that could allow remote code execution by an unauthenticated attacker (CVE-2024-13171)
signature verification error vulnerability that could allow remote code execution by an unauthenticated attacker (CVE-2024-13172)
Vulnerability Patches
Vulnerability Patches have been made available in the latest update. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.
CVE-2024-10811, CVE-2024-13158, CVE-2024-13159, CVE-2024-13160, CVE-2024-13161, CVE-2024-13162, CVE-2024-13163, CVE-2024-13164, CVE-2024-13165, CVE-2024-13166, CVE-2024-13167, CVE-2024-13168, CVE-2024-13169, CVE-2024-13171, CVE-2024-13172
Ivanti Endpoint Manager version: EPM 2024 January-2025 Security Update
Ivanti Endpoint Manager Versions: EPM 2022 SU6 January-2025 Security Update
References
[1] Security Advisory EPM January 2025 for EPM 2024 and EPM 2022 SU6
https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US&_gl=1*1dlaqtc*_gcl_au*MTY0NzEyMjczMS4xNzM3NDIzODI4