CVE-2021-3554criticalCWE-284

CVE-2021-3554: falha crítica em Bitdefender Endpoint Security Tools for Linux

Improper Access Control vulnerability in the patchesUpdate API

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Endpoint Security Tools+ Monitorar GravityZone

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9epss 2.1%
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Bitdefender · Endpoint Security Tools for LinuxBitdefender · GravityZoneBitdefender · Unified Endpoint
CVEs relacionadas — Bitdefender Endpoint Security Tools for Linux

No mesmo produto, das mais perigosas para as menos.

CVE-2021-3959MEDIUMServer-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145)EPSS 1.7%CVE-2021-3552MEDIUMInsufficient validation on regular expression in EPPUpdateService config file (VA-9825)EPSS 1.3%CVE-2021-3553MEDIUMServer-Side Request Forgery in EPPUpdateService remote config file (VA-9825)EPSS 1.3%CVE-2022-0677HIGHImproper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)EPSS 1.2%CVE-2021-3485MEDIUMImproper Input Validation in Bitdefender Endpoint Security Tools for LinuxEPSS 0.9%CVE-2021-3641MEDIUMImproper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921)EPSS 0.4%