CVE-2024-2223

HIGH

Bitdefender - SSRF

Title source: llm

Description

An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1

References (1)

[Vendor Advisory] https://www.bitdefender.com/support/security-advisories/incorrect-regular-expression-in-gravityzone-update-server-va-11465/

Scores

CVSS v3 8.1

EPSS 0.0050

EPSS Percentile 65.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-697 CWE-185

Status published

Products (3)

bitdefender/endpoint_security 7.0.5.200089

bitdefender/endpoint_security 7.9.9.380

bitdefender/gravityzone_control_center 6.36.1

Published Apr 09, 2024

Tracked Since Feb 18, 2026