CVE-2022-0677highCWE-130

CVE-2022-0677: high-severity vulnerability in Bitdefender Update Server

Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)

Published · Updated

Follow this CVE+ Monitor Endpoint Security Tools+ Monitor GravityZone

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.2%
Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Bitdefender · Endpoint Security Tools for LinuxBitdefender · Endpoint Security Tools for WindowsBitdefender · GravityZoneBitdefender · Update Server
Related CVEs — Bitdefender Update Server

In the same product, most dangerous first.

CVE-2021-3554CRITICALImproper Access Control vulnerability in the patchesUpdate APIEPSS 2.1%CVE-2021-3959MEDIUMServer-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145)EPSS 1.7%CVE-2021-3552MEDIUMInsufficient validation on regular expression in EPPUpdateService config file (VA-9825)EPSS 1.3%CVE-2021-3553MEDIUMServer-Side Request Forgery in EPPUpdateService remote config file (VA-9825)EPSS 1.3%CVE-2021-3485MEDIUMImproper Input Validation in Bitdefender Endpoint Security Tools for LinuxEPSS 0.9%CVE-2021-4199HIGHIncorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017)EPSS 0.8%