Out-of-Bounds Write Vulnerability in Ivanti EPM Software
CVE-2024-13167

7.5HIGH

Key Information:

Vendor

Ivanti
Status
Endpoint Manager
Vendor
CVE Published:
14 January 2025

What is CVE-2024-13167?

An out-of-bounds write vulnerability in Ivanti Endpoint Manager (EPM) enables a remote, unauthenticated attacker to exploit the software prior to specific January 2025 Security Updates. This flaw may lead to potential service disruptions, as it allows for manipulation that could result in a denial of service. Users must update their EPM software to the latest security patches to mitigate the risks associated with this vulnerability.

Affected Version(s)

Endpoint Manager 2024 January-2025 Security Update

Endpoint Manager 2024 January-2025 Security Update

Endpoint Manager 2022 SU6 January-2025 Security Update

References

https://forums.ivanti.com/s/article/Security-Advisory-EPM...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.