CVE-2024-4177
EUVD-2024-3273606.06.2024, 08:15
A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on premise.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| bitdefender | gravityzone | 𝑥 < 6.38.1-2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-116 - Improper Encoding or Escaping of OutputThe software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
- CWE-918 - Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References