Bitdefender GravityZone Update Server vulnerabilities

Latest Bitdefender GravityZone Update Server CVEs

Newest publication first

1. CVE-2025-2245 Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)

   Published 2025-04-04

   Medium·CVSS 6.9 EPSS 0.32%

   A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing nu...

2. CVE-2024-6980 Verbose error handling issue in GravityZone Update Server proxy service

   Published 2024-07-31

   Critical·CVSS 9.2 EPSS 0.56%

   A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.

3. CVE-2021-3823 Path traversal vulnerability in Bitdefender GravitZone Update Server in relay mode

   Published 2021-10-28

   Critical·CVSS 9.8 EPSS 1.1%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects: Bitdefender GravityZone versions prior t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.