CVE-2021-3553
Medium
Description
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
SeverityMedium
CVSS5.3
Exploit probability—
ProductBitdefender Endpoint Security Tools
PublishedNov 24, 2021
First seenNov 24, 2021
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- bitdefender endpoint_security_tools6.2.21.160, 6.6.27.390, 7.1.2.33 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bitdefender endpoint_security_tools | v < 6.2.21.160, 6.6.27.0 ≤ v < 6.6.27.390, 7.0.0.00 ≤ v < 7.1.2.33 | 6.2.21.160, 6.6.27.390, 7.1.2.33 |
| bitdefender gravityzone | 6.24.1-1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.