by Kastro
Paper/Archive/CVE-2022-2830

CVE-2022-2830

Bitdefender GravityZone Console On-Premise — Deserialization of Untrusted Data in GravityZone Console On-Premise (VA-10573)

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.9.609 × 2012.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the environment. This issue affects: Bitdefender GravityZone Console On-Premise versions prior to 6.29.2-1. Bitdefender GravityZone Cloud Console versions prior to 6.27.2-2.

Affected

ProductAffectedFixed inSource
GravityZone Console On-Premiseunspecified – < 6.29.2-16.29.2-1CNA
GravityZone Cloud Consoleunspecified – < 6.27.2-26.27.2-2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitdefender (CNA)8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbitdefender.com/support/security-advisories/deserialization-of-untrusted-data-in-gravityzone-console-va-10573