CVE-2024-2224CWE-22

Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)

High · published April 9, 2024

CVSS v3.1
8.1
EPSS
1%
Percentile
53.8
In the wild
Unconfirmed
What it is

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component:

Bitdefender Endpoint Security for Linux version 7.0.5.200089

Bitdefender Endpoint Security for Windows version 7.9.9.380

GravityZone Control Center (On Premises) version 6.36.1

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00731 · 53.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-04-09T13:01Z
EPSS history
Timeline
  • 09 APR 13:01Z
    Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)
    cvelistv5