CVE-2025-2243CWE-918

SSRF in GravityZone Console via DNS Truncation (VA-12634)

Medium · published April 4, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-04-04T09:53Z
EPSS history
Timeline
  • 04 APR 09:53Z
    SSRF in GravityZone Console via DNS Truncation (VA-12634)
    cvelistv5