Vulnerability · Published Apr 9, 2024 · Assigned by Bitdefender

CVE-2024-2224Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)

High 8.1

In plain English

A high-severity path traversal in Endpoint Security for Linux from Bitdefender. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.7%top 45.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1

Affected products (as reported)

Vendor	Product	Versions
Bitdefender	GravityZone Control Center (On Premises)	6.36.1
Bitdefender	Endpoint Security for Windows	7.9.9.380
Bitdefender	Endpoint Security for Linux	7.0.5.200089

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.bitdefender.com/support/security-advisories/privilege-escalation-via-the-gravityzone-productmanager-updateserver-kitsmanager-api-va-11466/