Incorrect Regular Expression in GravityZone Update Server (VA-11465)

CVE-2024-2223

8.1 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

BItdefender

GravityZone Update Server

An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component:

Bitdefender Endpoint Security for Linux version 7.0.5.200089
Bitdefender Endpoint Security for  Windows version 7.9.9.380
GravityZone Control Center (On Premises) version 6.36.1

An automatic update to the following versions fixes the issues:

Bitdefender Endpoint Security for Linux version 7.0.5.200090
Bitdefender Endpoint Security for Windows version 7.9.9.381
GravityZone Control Center (On Premises) version 6.36.1-1

An automatic update to the following versions fixes the issues:Bitdefender Endpoint Security for Linux version 7.0.5.200090Bitdefender Endpoint Security for Windows version 7.9.9.381GravityZone Control Center (On Premises) version 6.36.1-1

Nicolas VERDIER -- n1nj4sec