CVE-2024-2224

Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)

State: Published
Severity: 8.1 High
Published: Apr 9, 2024
Updated: Aug 1, 2024
Reserved: Mar 6, 2024

Description

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component:

Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	Bitdefender

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
GravityZone Control Center (On Premises)Bitdefender	6.36.1Affected
Endpoint Security for WindowsBitdefender	7.9.9.380Affected
Endpoint Security for LinuxBitdefender	7.0.5.200089Affected

References

https://www.bitdefender.com/support/security-advisories/privilege-escalation-via-the-gravityzone-productmanager-updateserver-kitsmanager-api-va-11466/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.