High severity8.1NVD Advisory· Published Apr 9, 2024· Updated Jun 17, 2026

CVE-2024-2224

Description

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component:

Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Bitdefender/Endpoint Security2 versions
cpe:2.3:a:bitdefender:endpoint_security:7.0.5.200089:*:*:*:*:linux:*:*+ 1 more
- cpe:2.3:a:bitdefender:endpoint_security:7.0.5.200089:*:*:*:*:linux:*:*
- cpe:2.3:a:bitdefender:endpoint_security:7.9.9.380:*:*:*:*:windows:*:*
Bitdefender/Gravityzone Control Center
cpe:2.3:a:bitdefender:gravityzone_control_center:6.36.1:*:*:*:on_premises:*:*:*
Bitdefender/Bitdefender Endpoint Security Tools for Windowsllm-fuzzy
Range: 7.9.9.380
Bitdefender/Gravityzonellm-fuzzy
Range: 6.36.1
Bitdefender/Endpoint Security Tools for Macllm-fuzzy3 versions
7.0.5.200089+ 2 more
- (no CPE)range: 7.0.5.200089
- (no CPE)range: 7.0.5.200089
- (no CPE)range: 7.9.9.380
Bitdefender/GravityZone Control Center (On Premises)cpe-rescue
Range: 6.36.1

Patches

Vulnerability mechanics

References

www.bitdefender.com/support/security-advisories/privilege-escalation-via-the-gravityzone-productmanager-updateserver-kitsmanager-api-va-11466/nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000