CVE-2024-4177CWE-116

Host whitelist parser issue in GravityZone Console On-Premise (VA-11554)

High · published June 6, 2024

CVSS v3.1
8.1
EPSS
0%
Percentile
36.4
In the wild
Unconfirmed
What it is

A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on premise.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00431 · 36.4th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2024-06-06T07:59Z
EPSS history
Timeline
  • 06 JUN 07:59Z
    Host whitelist parser issue in GravityZone Console On-Premise (VA-11554)
    cvelistv5