CVE-2024-6980criticalCWE-209

CVE-2024-6980: critical vulnerability in Bitdefender GravityZone Update Server

Verbose error handling issue in GravityZone Update Server proxy service

Published

Follow this CVE+ Monitor GravityZone Update Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 0.6%
A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Bitdefender · GravityZone Update Server
Related CVEs — Bitdefender GravityZone Update Server

In the same product, most dangerous first.

CVE-2021-3823HIGHPath traversal vulnerability in Bitdefender GravitZone Update Server in relay modeEPSS 1.1%CVE-2025-2245MEDIUMServer Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)EPSS 0.3%