CVE-2024-2223 HIGH

CVE-2024-2223: Incorrect Regular Expression in GravityZone Update Server (VA-11465)

Vendor Bitdefender
Product GravityZone Control Center (On Premises)
Weakness CWE-185
Published April 9, 2024
Last update August 12, 2024
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component:  Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for  Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1

Key dates

02Disclosure timeline

April 9, 2024 CVE published
August 12, 2024 Record updated