CVE-2022-2830 - Deserialization of Untrusted Data in GravityZone Console On-Premise (VA-10573)

Back Back to CVE browser

CRITICAL

Deserialization of Untrusted Data in GravityZone Console On-Premise (VA-10573)

Published Sep 5, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 0.92%

Description

Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the environment. This issue affects: Bitdefender GravityZone Console On-Premise versions prior to 6.29.2-1. Bitdefender GravityZone Cloud Console versions prior to 6.27.2-2.

Affected products

Vendor Bitdefender Product GravityZone Cloud Console Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <6.27.2-2
Vendor Bitdefender Product GravityZone Console On-Premise Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <6.29.2-1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bitdefender

GravityZone Cloud Console

n/a

Version	Status	Constraints
unspecified	affected	<6.27.2-2

Bitdefender

GravityZone Console On-Premise

n/a

Version	Status	Constraints
unspecified	affected	<6.29.2-1

Remediation

Vendor solution

An automatic update to the following software versions fixes the issue:

Bitdefender GravityZone Console On-Premise version 6.29.2-1. Bitdefender GravityZone Cloud Console version 6.27.2-2.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (1)

https://www.bitdefender.com/support/security-advisories/deserialization-of-untrusted-data-in-gravityzone-console-va-10573
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://www.bitdefender.com/support/security-advisories/deserialization-of-untrusted-data-in-gravityzone-console-va-10573		x_refsource_MISCVendor Advisory