Cyber Resilience

CVE-2024-6980

SSRF in Bitdefender Gravityzone ≤ 6.38.1-5

SSRFInfo Disclosure
Published
31 July 2024
Modified
07 February 2025
CVSS Score v4 9.2
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0056 43th percentile
Risk Priority 37 floored blend · peak EPSS

Summary

CVE-2024-6980 is a critical-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Bitdefender Gravityzone. Its CVSS base score is 9.2 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Software (T1592.002); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access ControlA10:2025 Mishandling of Exceptional Conditions

EU & UK References

Vulnerability Data

A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.

CWE(s)
CWE-209CWE-918

Related Threats

MITRE ATT&CK Enterprise Techniques

T1592.002 Software Reconnaissance
Adversaries may gather information about the victim's host software that can be used during targeting.
attack.mitre.org →
T1082 System Information Discovery Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1592 Gather Victim Host Information Reconnaissance
Adversaries may gather information about the victim's hosts that can be used during targeting.
attack.mitre.org →
T1595 Active Scanning Reconnaissance
Adversaries may execute active reconnaissance scans to gather information that can be used during targeting.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-2243Same product: Bitdefender Gravityzone
CVE-2024-4177Same product: Bitdefender Gravityzone
CVE-2025-2244Same product: Bitdefender Gravityzone
CVE-2025-2245Same vendor: Bitdefender
CVE-2026-49979Shared CWE-209, CWE-918
CVE-2024-2224Same vendor: Bitdefender
CVE-2025-5317Same vendor: Bitdefender
CVE-2023-3633Same vendor: Bitdefender
CVE-2026-10047Same vendor: Bitdefender
CVE-2026-10046Same vendor: Bitdefender

Affected Assets

bitdefender
gravityzone
≤ 6.38.1-5

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V16.5.1
  • V1.3.6
  • V1.5.3
  • V5.3.2

Mitigating Controls (NIST 800-53 r5) AI

SI-11 Error Handling good match

si-11 directly requires error messages to avoid revealing exploitable information about the system or its data.

AC-4 Information Flow Enforcement good match

Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.

SI-10 Information Input Validation good match

Input validation directly stops untrusted URLs from being accepted and fetched without destination checks.

SC-7 Boundary Protection partial match

Boundary protection limits the network reach of server-initiated requests even if SSRF occurs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require sanitized error handling to prevent sensitive data disclosure.

DE.CM-09 partial match
prevents

Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover and record SSRF flaws in web applications.

PR.IR-01 partial match
prevents

Network segmentation and egress controls can limit the damage from successful SSRF requests.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.28 Secure coding mostly match
prevents

Secure coding standards explicitly forbid exposing sensitive data in errors.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect error messages that leak sensitive information.

A.5.7 Threat intelligence partial match
prevents

Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.

A.8.15 Logging partial match
degrades

Logging policy can require suppression of sensitive data in error messages.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates error-handling rules that avoid leaking sensitive information.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify safe error messaging.

References