Bitdefender Patches Critical Vulnerability in GravityZone Update Server
Bitdefender, a leading cybersecurity solutions provider, has issued an urgent patch for a critical vulnerability (CVE-2024-6980) in its GravityZone Update Server. The vulnerability, discovered by Nicolas VERDIER of n1nj4sec, could potentially allow attackers to perform server-side request forgery attacks, leading to unauthorized access and data breaches.
The GravityZone Update Server is a core component of Bitdefender’s GravityZone enterprise security platform. It’s responsible for distributing critical security updates, including antivirus definitions, patches, and software upgrades, to all protected devices within the network.
The vulnerability (CVE-2024-6980) stems from verbose error handling in the proxy service of the GravityZone Update Server. Attackers can exploit this weakness to manipulate the server into making unintended requests to other systems, potentially exposing sensitive data or compromising network security.
Bitdefender has rated the vulnerability with a CVSSv4 score of 9.2, indicating a critical severity level.
The vulnerability affects Bitdefender GravityZone Console versions before 6.38.1-5 running on-premises installations only. Cloud-based GravityZone instances are not impacted.
Bitdefender has released an automatic update to GravityZone Console version 6.38.1-5 that addresses the vulnerability. All GravityZone customers are strongly advised to apply the update immediately to ensure the security of their enterprise environments.
