Skip to main content

Gravityzone CVE-2024-6980

CRITICAL
Error Message Information Leak (CWE-209)
2024-07-31 cve-requests@bitdefender.com
SSRF Information Disclosure Gravityzone
9.2
CVSS 4.0 · Vendor: bitdefender
Share

Severity by source

Vendor (bitdefender) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (bitdefender) · only source for this CVE.

CVSS VectorVendor: bitdefender

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
Jul 31, 2024 - 07:15 cve.org
CRITICAL 9.2

DescriptionCVE.org

A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.

AnalysisAI

A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-209. A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise. Affected products include: Bitdefender Gravityzone. Version information: before 6.38.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Gravityzone

View all
CVE-2018-8955 CRITICAL POC
9.8 Oct 24

The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installatio
CVE-2014-5350 MEDIUM POC
5.0 Aug 19

Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read
CVE-2021-3554 CRITICAL
10.0 Nov 24

Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for
CVE-2025-2244 CRITICAL
9.5 Apr 04

A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely
CVE-2024-4177 CRITICAL
9.8 Jun 06

A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to ca
CVE-2022-2830 CRITICAL
9.8 Sep 05

Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console a
CVE-2021-3823 CRITICAL
9.8 Oct 28

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer compone
CVE-2021-3960 HIGH
7.8 Dec 16

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer compone
CVE-2022-0677 HIGH
7.5 Apr 07

Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint
CVE-2021-3959 HIGH
7.5 Dec 16

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security To
CVE-2021-3553 HIGH
7.5 Nov 24

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows
CVE-2021-3552 HIGH
7.5 Nov 24

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security To

Same weakness CWE-209 – Error Message Information Leak

View all
CVE-2025-47813 MEDIUM POC
4.3
CVE-2017-7551 CRITICAL POC
9.8
CVE-2026-48039 CRITICAL POC
9.1
CVE-2022-31140 CRITICAL POC
9.1
CVE-2024-23689 HIGH POC
8.8
CVE-2018-17961 HIGH POC
8.6
CVE-2023-37306 HIGH POC
7.5
CVE-2026-29146 HIGH POC
7.5

Same technique SSRF

View all
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8
CVE-2026-15409 CRITICAL POC
10.0
CVE-2024-54385 HIGH POC
7.2
CVE-2022-45835 MEDIUM POC
5.8
CVE-2024-54330 HIGH POC
7.2
CVE-2026-20230 HIGH POC
8.6

Share

CVE-2024-6980 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy