CVE-2024-4177 is a high severity (CVSS 8.1) server-side request forgery in the proxy service of the Bitdefender GravityZone Update Server. It affects only on-premise GravityZone Console versions before 6.38.1-2. The fix is to move to 6.38.1-2 or later, and cloud-hosted consoles are outside the scope the record describes.
What's affected
Per the NVD record, the issue only affects GravityZone Console versions before 6.38.1-2 that run on premises. The CPE entry in the record carries an on-premise qualifier, which agrees with that wording.
The record's CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack complexity is high, which is why this sits at 8.1 and not higher, but no login and no user interaction are needed. The record carries two weakness tags, CWE-918 (server-side request forgery) and CWE-116 (improper encoding or escaping of output). KEV status in the record is false.
The vendor notice linked from the record returned a page not found response when we tried it, so the fixed version comes from the record's own description. Confirm it with Bitdefender before you act on it.
How to check if you're exposed
Log in to the on-premise console and read the product version in the About or Help area. If it shows a version below 6.38.1-2, you are in scope. If your console is the cloud-hosted service, the record does not apply to it, though your vendor contact can confirm.
Also check where the Update Server proxy component is deployed and which networks it can reach. SSRF turns a server into a request relay, so the damage depends on what internal addresses that server can talk to. Check egress rules on the host for metadata endpoints, management interfaces and internal admin panels.
If you keep a software inventory, search it for GravityZone and compare versions. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related entries.
What to do now
- Find every on-premise GravityZone Console and note its version.
- Upgrade any console older than 6.38.1-2, and verify the target version against Bitdefender's current notice.
- Restrict outbound connections from the console and update server to the destinations they actually need.
- Review proxy and firewall logs for unexpected requests from the console host to internal addresses.
- Record in your asset register that this host is a request relay candidate, so future reviews include it.
Why it matters
Server-side request forgery lets an outsider make a trusted server send requests on their behalf. The advisory language points at a host whitelist parser: the check that decides which destinations the proxy may contact did not parse hosts the way the code making the request did. When two parts of a system disagree about what a host name means, an allow list stops protecting anything.
Security management consoles are a good target for this class because they sit inside the network, hold credentials and can reach many systems. High complexity slows an attacker down, it does not remove the need to patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect Bitdefender's cloud console?
The record says the issue only affects on-premise consoles before 6.38.1-2. Ask Bitdefender if you need written confirmation for a cloud tenant.
Sources
- Bitdefender security advisory, listed in the NVD record. It returned a page not found response during this review.
- Safeguard Gold entry for CVE-2024-4177
Last reviewed: 19 October 2026.
