InfoSecBulletin Cybersecurity for mankind
The Bitdefender GravityZone Update Server is vulnerable to server-side request forgery (SSRF) because of an incorrect regular expression.
Bitdefender’s GravityZone:
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
Hacker exploited Samsung MagicINFO 9 Server RCE flaw
CISA adds Langflow flaw to its KEV catalog
Bitdefender’s GravityZone Update Server has a critical vulnerability with a CVSS score of 8.1. It could allow an attacker remote network access to compromise the server with low privileges.
Bitdefender GravityZone Update Server suffers from an Incorrect Regular Expression vulnerability, which enables attackers to forge server-side requests and manipulate the update relay configuration.
A weakness in the implemented regular expression allows unauthorized modification, potentially leading to a compromise of the update relay, which impacts Bitdefender Endpoint Security for Linux (version 7.0.5.200089), Endpoint Security for Windows (version 7.9.9.380), and GravityZone Control Center (On-Premises version 6.36.1).
A critical security update has been released to address vulnerabilities (CVE-2024-2223 & CVE-2024-2224), potentially allowing attackers to escalate privileges or potentially manipulate the update server.
Users of Bitdefender Endpoint Security for Linux (version 7.0.5.200089) and Windows (version 7.9.9.380), along with those managing GravityZone Control Center (On-Premises version 6.36.1), should upgrade to the corresponding patched versions (Linux version 7.0.5.200090, Windows version 7.9.9.381, and GravityZone Control Center version 6.36.1-1) to mitigate these risks.
Bitdefender released security updates to address two vulnerabilities (CVE-2024-2223 and CVE-2024-2224) in GravityZone. These updates impact Bitdefender Endpoint Security for Linux (version 7.0.5.200089), Endpoint Security for Windows (version 7.9.9.380), and GravityZone Control Center (On-Premises version 6.36.1).
CVE-2024-2223 allows attackers to manipulate the update server through a regular expression flaw potentially.
CVE-2024-2224 is more severe, enabling privilege escalation on affected systems. Upgrading to Bitdefender Endpoint Security for Linux version 7.0.5.200090, Endpoint Security for Windows version 7.9.9.381, and GravityZone Control Center (On-Premises) version 6.36.1-1 mitigates the vulnerabilities.
Source: Bitdefendr, cybersecuritynews
