What’s Vulnerable › Vulnerabilities

CVE-2024-2223: Incorrect Regular Expression in GravityZone Update Server (VA-11465)

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-09 · updated 2026-06-17
• Weakness: CWE-185

Description

An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component:  Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for  Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1

Affected products

• Bitdefender Endpoint Security Tools for Mac: 7.0.5.200089, 7.9.9.380
• Bitdefender Gravityzone Control Center: 6.36.1

References

• https://www.bitdefender.com/support/security-advisories/incorrect-regular-expression-in-gravityzone-update-server-va-11465/
• https://www.bitdefender.com/support/security-advisories/incorrect-regular-expression-in-gravityzone-update-server-va-11465/

Get alerted when CVE-2024-2223 or the next vulnerability affects your stack