CVE-2024-2223

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component: 

Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for  Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-185CWE-697

Affected software

VendorProductVersions
BitdefenderGravityZone Control Center (On Premises)6.36.1
BitdefenderEndpoint Security for Windows7.9.9.380
BitdefenderEndpoint Security for Linux7.0.5.200089
bitdefendergravityzone6.36.1
bitdefenderendpoint_security_for_windows7.9.9.380
bitdefenderendpoint_security_for_linux7.0.5.200089

References

Timeline

Published
Apr 9, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-222305.4Dell Unity, versions prior to 5.4, contains a Cross-site scripting vulnerability. An authenticated attacker could potentially exploit this vCVE-2024-222315.0Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create CVE-2024-222327.7A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary CVE-2024-222337.5In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-CVE-2024-222347.4In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control wCVE-2024-222356.7VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local systemCVE-2024-222365.5In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution iCVE-2024-222377.8Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for NetworksCVE-2024-222384.8Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject maCVE-2024-222397.8Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for NetworksCVE-2024-22249.8Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GrCVE-2024-222404.9Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerabilit
CVE-2024-2223: Critical severity, CVSS 9.8 | Vulnix