InfoSecBulletin Cybersecurity for mankind
Bitdefender fixed a serious vulnerability (CVE-2024-4177, CVSS 8.1) in its GravityZone Console On-Premise product. This flaw, found by security researcher Nicolas Verdier (n1nj4sec), could enable attackers to carry out server-side request forgery (SSRF) attacks, possibly resulting in unauthorized access and data breaches.
GravityZone Console is a security management platform by Bitdefender. It helps monitor and manage security across different endpoints, networks, and cloud environments. The vulnerability affects on-premise versions of GravityZone Console before version 6.38.1-2.
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
The problem is a flaw in the host whitelist parser of the proxy service. An attacker could exploit this flaw to manipulate server requests, causing unintended actions or leaking sensitive information. These vulnerabilities are very dangerous as they can bypass security controls and allow unauthorized access to internal systems.
Bitdefender has fixed the issue with an automatic update to version 6.38.1-2 of the GravityZone Console On-Premise. Users with affected versions should update to avoid potential risks from this vulnerability.
