This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Ivanti Endpoint Manager, Application Control and Avalanche fix several vulnerabilities

Ivanti fixes several critical and high-severity vulnerabilities in Ivanti Endpoint Manager (EPM), Application Control and Avalanche. The most severe are described below; the remaining ones can be found at [1][2][3]. Products and their fixes: Ivanti Endpoint Manager - 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update [1] Ivanti Application Control - 2024.3 HF1, 2024.1 HF2, 2023.3 HF3 [2] Ivanti Avalanche - 6.4.7 [3]

Ivanti EPM - sensitive information leakage (CVE-2024-10811, CVE-2024-13161, CVE-2024-13160, CVE-2024-13159)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can obtain sensitive information in Ivanti EPM [1].

The vulnerability is present in product:

  • Ivanti Endpoint Manager; <=2024 November security update; <=2022 SU6 November security update

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 1. 2025.

Ivanti EPM - remote code execution (CVE-2024-13172, CVE-2024-13171, CVE-2024-13163)
CVSS 7.8 (High)

An unauthenticated remote attacker can achieve remote code execution in Ivanti EPM due to improper signature verification. Interaction with a local user is required [1].

The vulnerability is present in product:

  • Ivanti Endpoint Manager; <=2024 November security update; <=2022 SU6 November security update

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 1. 2025.

Ivanti EPM - privilege escalation (CVE-2024-13169)
CVSS 7.8 (High)

An authenticated local attacker can elevate their privileges in Ivanti EPM [1].

The vulnerability is present in product:

  • Ivanti Endpoint Manager; <=2024 November security update; <=2022 SU6 November security update

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 1. 2025.

Ivanti Application Control - configured protection bypass (CVE-2024-10630)
CVSS 7.8 (High)

An authenticated local attacker can bypass the application blocking features in Ivanti Application Control due to a race condition flaw [2].

The vulnerability is present in products:

  • Ivanti Application Control; <=2024.3; <=2024.1; <=2023.3
  • Ivanti Security Controls; <=2024.4.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

Ivanti Avalanche - sensitive information leakage (CVE-2024-13180)
CVSS 7.5 (High)

An unauthenticated remote attacker can obtain sensitive information in Ivanti Avalanche [3].

The vulnerability is present in product:

  • Ivanti Avalanche; <=6.4.6

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

  • CVE-2024-13180 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 1. 2025.

Ivanti Avalanche - authentication bypass (CVE-2024-13181, CVE-2024-13179)
CVSS 7.3 (High)

An unauthenticated remote attacker can bypass authentication in Ivanti Avalanche [3].

The vulnerability is present in product:

  • Ivanti Avalanche; <=6.4.6

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

More information:

  • CVE-2024-13181 at cve.org, NVD
  • CVE-2024-13179 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
  • CWE-288: Authentication Bypass Using an Alternate Path or Channel at cwe.mitre.org

The vulnerability was publicly disclosed 9. 1. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 21. 1. 2025.

CESNET, z.s.p.o. Logo