CVE-2024-2223highCWE-185

CVE-2024-2223: high-severity vulnerability in Bitdefender Endpoint Security for Linux

Incorrect Regular Expression in GravityZone Update Server (VA-11465)

Published · Updated

Follow this CVE+ Monitor Endpoint Security+ Monitor GravityZone Control Center

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.5%
An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component:  Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for  Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Bitdefender · Endpoint Security for LinuxBitdefender · Endpoint Security for WindowsBitdefender · GravityZone Control Center (On Premises)
Related CVEs — Bitdefender Endpoint Security for Linux

In the same product, most dangerous first.

CVE-2024-2224HIGHPrivilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)EPSS 0.7%