title:  Incorrect Regular Expression in GravityZone Update Server (VA-11465)
description: An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component:
Bitdefender Endpoint Security for Linux version 7.0.5.200089
Bitdefender Endpoint Security for  Windows version 7.9.9.380
GravityZone Control Center (On Premises) version 6.36.1
problem types: CWE-185: Incorrect Regular Expression
affected:
{
defaultStatus: affected
product: GravityZone Control Center (On Premises)
vendor: Bitdefender
versions:
status: affected, version: 6.36.1
}
{
defaultStatus: unaffected
product: Endpoint Security for Windows
vendor: Bitdefender
versions:
status: affected, version: 7.9.9.380
}
{
defaultStatus: unaffected
product: Endpoint Security for Linux
vendor: Bitdefender
versions:
status: affected, version: 7.0.5.200089
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: An automatic update to the following versions fixes the issues:
Bitdefender Endpoint Security for Linux version 7.0.5.200090
Bitdefender Endpoint Security for  Windows version 7.9.9.381
GravityZone Control Center (On Premises) version 6.36.1-1