Home

Description

A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1.

PUBLISHED Reserved 2025-03-12 | Published 2025-04-04 | Updated 2025-04-04 | Assigner Bitdefender




MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Problem types

CWE-918 Server-Side Request Forgery (SSRF)

Product status

Default status
unaffected

Any version before 6.41.2-1
affected

Credits

Nicolas Verdier (@n1nj4sec) finder

References

www.bitdefender.com/...e-console-via-dns-truncation-va-12634

cve.org (CVE-2025-2243)

nvd.nist.gov (CVE-2025-2243)

Download JSON