CVE-2021-3554criticalCWE-284

CVE-2021-3554: critical vulnerability in Bitdefender Endpoint Security Tools for Linux

Improper Access Control vulnerability in the patchesUpdate API

Published · Updated

Follow this CVE+ Monitor Endpoint Security Tools+ Monitor GravityZone

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9epss 2.1%
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Bitdefender · Endpoint Security Tools for LinuxBitdefender · GravityZoneBitdefender · Unified Endpoint
Related CVEs — Bitdefender Endpoint Security Tools for Linux

In the same product, most dangerous first.

CVE-2021-3959MEDIUMServer-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145)EPSS 1.7%CVE-2021-3552MEDIUMInsufficient validation on regular expression in EPPUpdateService config file (VA-9825)EPSS 1.3%CVE-2021-3553MEDIUMServer-Side Request Forgery in EPPUpdateService remote config file (VA-9825)EPSS 1.3%CVE-2022-0677HIGHImproper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)EPSS 1.2%CVE-2021-3485MEDIUMImproper Input Validation in Bitdefender Endpoint Security Tools for LinuxEPSS 0.9%CVE-2021-3641MEDIUMImproper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921)EPSS 0.4%