{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-29T17:01:30.010","vulnerabilities":[{"cve":{"id":"CVE-2024-2224","sourceIdentifier":"cve-requests@bitdefender.com","published":"2024-04-09T13:15:33.357","lastModified":"2026-06-17T07:23:58.237","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component: \n\nBitdefender Endpoint Security for Linux version 7.0.5.200089\nBitdefender Endpoint Security for  Windows version 7.9.9.380\nGravityZone Control Center (On Premises) version 6.36.1\n"},{"lang":"es","value":"La vulnerabilidad de limitación inadecuada de un nombre de ruta a un directorio restringido (\"Path Traversal\") en el componente UpdateServer de Bitdefender GravityZone permite a un atacante ejecutar código arbitrario en instancias vulnerables. Este problema afecta a los siguientes productos que incluyen el componente vulnerable: Bitdefender Endpoint Security para Linux versión 7.0.5.200089 Bitdefender Endpoint Security para Windows versión 7.9.9.380 GravityZone Control Center (On Premises) versión 6.36.1"}],"affected":[{"source":"cve-requests@bitdefender.com","affectedData":[{"vendor":"Bitdefender","product":"GravityZone Control Center (On Premises)","defaultStatus":"unaffected","versions":[{"version":"6.36.1","status":"affected"}]},{"vendor":"Bitdefender","product":"Endpoint Security for Windows","defaultStatus":"unaffected","versions":[{"version":"7.9.9.380","status":"affected"}]},{"vendor":"Bitdefender","product":"Endpoint Security for Linux","defaultStatus":"unaffected","versions":[{"version":"7.0.5.200089","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"bitdefender","product":"gravityzone","defaultStatus":"unknown","cpes":["cpe:2.3:a:bitdefender:gravityzone:6.36.1:*:*:*:*:*:*:*"],"versions":[{"version":"6.36.1","status":"affected"}]},{"vendor":"bitdefender","product":"endpoint_security_for_windows","defaultStatus":"unknown","cpes":["cpe:2.3:a:bitdefender:endpoint_security_for_windows:7.9.9.380:*:*:*:*:*:*:*"],"versions":[{"version":"7.9.9.380","status":"affected"}]},{"vendor":"bitdefender","product":"endpoint_security_for_linux","defaultStatus":"unknown","cpes":["cpe:2.3:a:bitdefender:endpoint_security_for_linux:70.5.200089:*:*:*:*:*:*:*"],"versions":[{"version":"70.5.200089","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve-requests@bitdefender.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-04-09T14:18:06.302656Z","id":"CVE-2024-2224","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-requests@bitdefender.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bitdefender:endpoint_security:7.0.5.200089:*:*:*:*:linux:*:*","matchCriteriaId":"AAB89966-3C21-4B7D-AC06-852112583783"},{"vulnerable":true,"criteria":"cpe:2.3:a:bitdefender:endpoint_security:7.9.9.380:*:*:*:*:windows:*:*","matchCriteriaId":"D1F56724-5FFE-414B-95D1-96351A0F9686"},{"vulnerable":true,"criteria":"cpe:2.3:a:bitdefender:gravityzone_control_center:6.36.1:*:*:*:on_premises:*:*:*","matchCriteriaId":"75899627-A80E-49B6-9EBA-433DF7F2BE37"}]}]}],"references":[{"url":"https://www.bitdefender.com/support/security-advisories/privilege-escalation-via-the-gravityzone-productmanager-updateserver-kitsmanager-api-va-11466/","source":"cve-requests@bitdefender.com","tags":["Vendor Advisory"]},{"url":"https://www.bitdefender.com/support/security-advisories/privilege-escalation-via-the-gravityzone-productmanager-updateserver-kitsmanager-api-va-11466/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}