CVE-2025-2243

A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1.

Score

CVSS 3.1 7.3 High

Status

Analyzed - cve-requests@bitdefender.com

Published

2025-04-04

Last modified

2025-04-04

Weaknesses

CWE-918

Affected products

• Gravityzone (Bitdefender)
• Gravityzone Console (Bitdefender)

References

• https://www.bitdefender.com/support/security-advisories/ssrf-in-gravityzone-console-via-dns-truncation-va-12634