Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2024-2224

Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Bitdefender

Description

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Bitdefender GravityZone Control Center (On Premises)

Default version status: unaffected

  • 6.36.1affected

Bitdefender Endpoint Security for Windows

Default version status: unaffected

  • 7.9.9.380affected

Bitdefender Endpoint Security for Linux

Default version status: unaffected

  • 7.0.5.200089affected

References