GravityZone vulnerabilities

8 known vulnerabilities in GravityZone from Bitdefender. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  GravityZone Console: Deserialization of Untrusted Data

  CVE-2025-2244Apr 4, 2025BitdefenderEPSS 1.11%

  A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP o

• 7.3 High severity

  GravityZone Console: Server-Side Request Forgery

  CVE-2025-2243Apr 4, 2025Bitdefender

  A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execu

• 9.8 Critical severity

  GravityZone Update Server: Server-Side Request Forgery

  CVE-2024-6980Jul 31, 2024Bitdefender

  A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.

• 9.8 Critical severity

  GravityZone Console On-Premise: Server-Side Request Forgery

  CVE-2024-4177Jun 6, 2024Bitdefender

  A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on premise.

• 9.8 Critical severity

  GravityZone Control Center (On Premises): Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-2224Apr 9, 2024Bitdefender

  Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following product

• 9.8 Critical severity

  GravityZone Control Center (On Premises): Incorrect Comparison

  CVE-2024-2223Apr 9, 2024Bitdefender

  An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component: Bitdefe

• 9.8 Critical severity

  GravityZone Console On-Premise: Deserialization of Untrusted Data

  CVE-2022-2830Sep 5, 2022Bitdefender

  Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the environment. This issue affects: Bitdefender GravityZone Console On-Premise versions prior

• 7.5 High severity

  Update Server: Improper Handling of Length Parameter Inconsistency

  CVE-2022-0677Apr 7, 2022BitdefenderEPSS 1.25%

  Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bi