CVE-2014-5350
Bitdefender GravityZone < 5.1.5.386 - Path Traversal via Web Console or Update Server
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-5350. PoCs published by SEC Consult.
AI-analyzed exploit summary The advisory details multiple critical vulnerabilities in Bitdefender GravityZone, including unauthenticated local file disclosure, insecure MongoDB service configuration with hardcoded credentials, and missing authentication for certain administrative scripts. These vulnerabilities allow attackers to gain system and database access, as well as manage endpoints.
Description
Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the id parameter to webservice/CORE/downloadFullKitEpc/a/1 in the Web Console or (2) %2E%2E (encoded dot dot) in the default URI to port 7074 on the Update Server.
Exploits (1)
The advisory details multiple critical vulnerabilities in Bitdefender GravityZone, including unauthenticated local file disclosure, insecure MongoDB service configuration with hardcoded credentials, and missing authentication for certain administrative scripts. These vulnerabilities allow attackers to gain system and database access, as well as manage endpoints.