CVE-2021-3554criticalCWE-284

CVE-2021-3554: fallo crítico en Bitdefender Endpoint Security Tools for Linux

Improper Access Control vulnerability in the patchesUpdate API

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Endpoint Security Tools+ Monitorear GravityZone

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9epss 2.1%
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
Bitdefender · Endpoint Security Tools for LinuxBitdefender · GravityZoneBitdefender · Unified Endpoint
CVEs relacionadas — Bitdefender Endpoint Security Tools for Linux

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-3959MEDIUMServer-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145)EPSS 1.7%CVE-2021-3552MEDIUMInsufficient validation on regular expression in EPPUpdateService config file (VA-9825)EPSS 1.3%CVE-2021-3553MEDIUMServer-Side Request Forgery in EPPUpdateService remote config file (VA-9825)EPSS 1.3%CVE-2022-0677HIGHImproper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)EPSS 1.2%CVE-2021-3485MEDIUMImproper Input Validation in Bitdefender Endpoint Security Tools for LinuxEPSS 0.9%CVE-2021-3641MEDIUMImproper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921)EPSS 0.4%