CVE-2024-2224 HIGH

CVE-2024-2224: Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)

Vendor Bitdefender
Product GravityZone Control Center (On Premises)
Weakness CWE-22 · Path traversal
Published April 9, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1

Key dates

02Disclosure timeline

April 9, 2024 CVE published
August 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2016-20076 WordPress Simple-Backup 2.7.11 Arbitrary File Deletion and Download CVE-2024-44014 WordPress Vmax Project Manager plugin <= 1.0 - Local File Inclusion to RCE vulnerability CVE-2024-22328 IBM Maximo Application Suite information disclosure CVE-2026-42549 Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root CVE-2023-40492 LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion Vulnerability