CVE-2021-3554
Critical
Description
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
SeverityCritical
CVSS9.0
Exploit probability—
ProductBitdefender Endpoint Security Tools
PublishedNov 24, 2021
First seenNov 24, 2021
Weakness typeCWE-284Improper access control
How to fix
Update
- bitdefender endpoint_security_tools6.6.27.390, 7.1.2.33 or later
- bitdefender gravityzone6.24.1-1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bitdefender endpoint_security_tools | v < 6.6.27.390, 7.0.0.00 ≤ v < 7.1.2.33 | 6.6.27.390, 7.1.2.33 |
| bitdefender gravityzone | v < 6.24.1-1, 6.24.1-1 | 6.24.1-1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.