Vulnerability · Published Apr 9, 2024 · Assigned by Bitdefender
CVE-2024-2223 Incorrect Regular Expression in GravityZone Update Server (VA-11465)
High 8.1
In plain English
A high-severity security flaw in Endpoint Security for Linux from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | GravityZone Control Center (On Premises) | 6.36.1 |
| Bitdefender | Endpoint Security for Windows | 7.9.9.380 |
| Bitdefender | Endpoint Security for Linux | 7.0.5.200089 |
Weakness: CWE-185 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H