VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Apr 4, 2025· Updated Jun 17, 2026

CVE-2025-2245

CVE-2025-2245

Description

A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Bitdefender/Gravityzone Update Server3 versions
    cpe:2.3:a:bitdefender:gravityzone_update_server:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:bitdefender:gravityzone_update_server:*:*:*:*:*:*:*:*range: <3.5.2.689
    • (no CPE)
    • (no CPE)range: 0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.