PT-2024-38018 · Bitdefender · Gravityzone Console

Published 2024-07-31 · Updated 2024-08-12 · CVE-2024-6980

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GravityZone Console versions prior to 6.38.1-5

Description A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions running on premise.

Recommendations For GravityZone Console versions prior to 6.38.1-5, upgrade the affected component to version 6.38.1-5 or later to mitigate the risk. As a temporary workaround, consider restricting access to the proxy service to minimize the risk of exploitation.

Fix

Generation of Error Message Containing Sensitive Information

SSRF

Weakness Enumeration

CWE-209

CWE-918

Related Identifiers

CVE-2024-6980

Affected Products

Gravityzone Console

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-6980 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6980 · Vendor Advisory
• https://t.me/cvenotify/88014 · Telegram Post
• https://t.me/cvedetector/2117 · Telegram Post
• https://twitter.com/oktsec/status/1822984948715786579 · Twitter Post
• https://bitdefender.com/consumer/support/support/security-advisories/verbose-error-handling-issue-in-gravityzone-update-server-proxy-service · Note