Vulnerability · Published Apr 4, 2025 · Assigned by Bitdefender
CVE-2025-2243SSRF in GravityZone Console via DNS Truncation (VA-12634)
Medium 6.9
In plain English
A medium-severity server-side request forgery in GravityZone Console from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | GravityZone Console | 0 – before 6.41.2-1 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L