CVE-2024-2224 Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)
Attackers can exploit a path traversal flaw in the UpdateServer component to execute arbitrary code and escalate privileges on GravityZone instances.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2224?
CVE-2024-2224 is a high-severity path traversal vulnerability in Bitdefender Endpoint Security for Linux, published on 9 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component:
Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1
Weakness: CWE-22
Which versions are affected by CVE-2024-2224?
It affects 2 products.
Products include Bitdefender Endpoint Security, Bitdefender Gravityzone Control Center.
How do I fix CVE-2024-2224?
No fix has been published for CVE-2024-2224 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-2224 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2224 exists.
Other vulnerabilities in Bitdefender Endpoint Security for Linux
- CVE-2020-8108 Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759)
- CVE-2024-2223 Incorrect Regular Expression in GravityZone Update Server (VA-11465)
- CVE-2020-8097 Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646)
- CVE-2025-5317 Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac
Sources
Also known as GHSA-2x49-6qmf-g5cq.