Vulnerabilities > CVE-2021-3554 - Unspecified vulnerability in Bitdefender Endpoint Security Tools and Gravityzone

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

bitdefender

NVD

Published: 2021-11-24

Updated: 2022-04-25

Summary

Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.

Vulnerable Configurations

Part	Description	Count
Application	Bitdefender Bitdefender Endpoint Security Tools - Bitdefender Endpoint Security Tools 6.2.21.18 Bitdefender Endpoint Security Tools 6.2.21.155 Bitdefender Endpoint Security Tools 6.6.8.115 Bitdefender Endpoint Security Tools 6.6.11.163 Bitdefender Endpoint Security Tools 6.6.12.170 Bitdefender Endpoint Security Tools 6.6.18.261 Bitdefender Endpoint Security Tools 6.6.23.320 Bitdefender Endpoint Security Tools * Bitdefender Gravityzone - Bitdefender Gravityzone 3.3.8.249 Bitdefender Gravityzone 5.1.5.386 Bitdefender Gravityzone 5.1.11.432 Bitdefender Gravityzone 5.1.21.465 Bitdefender Gravityzone 5.1.23-470 Bitdefender Gravityzone 5.1.23-471 Bitdefender Gravityzone 5.1.23-472 Bitdefender Gravityzone 5.1.23-473 Bitdefender Gravityzone 5.1.23-474 Bitdefender Gravityzone 5.1.23-476 Bitdefender Gravityzone 5.1.23-477 Bitdefender Gravityzone 5.1.25-483 Bitdefender Gravityzone 5.1.25-487 Bitdefender Gravityzone 5.1.25-525 Bitdefender Gravityzone 5.1.25-526 Bitdefender Gravityzone 6.1.27-537 Bitdefender Gravityzone 6.1.29-540 Bitdefender Gravityzone 6.1.29-545 Bitdefender Gravityzone 6.1.29-546 Bitdefender Gravityzone 6.1.29-547 Bitdefender Gravityzone 6.1.41-549 Bitdefender Gravityzone 6.2.1-30 Bitdefender Gravityzone 6.2.1-34 Bitdefender Gravityzone 6.2.1-35 Bitdefender Gravityzone 6.3.1-4 Bitdefender Gravityzone 6.3.3-2 Bitdefender Gravityzone 6.3.3-3 Bitdefender Gravityzone 6.3.3-4 Bitdefender Gravityzone 6.3.3-8 Bitdefender Gravityzone 6.3.3-9 Bitdefender Gravityzone 6.3.5-2 Bitdefender Gravityzone 6.3.5-3 Bitdefender Gravityzone 6.3.5-4 Bitdefender Gravityzone 6.3.7-1 Bitdefender Gravityzone 6.3.7-7 Bitdefender Gravityzone 6.3.9-3 Bitdefender Gravityzone 6.5.3-70 Bitdefender Gravityzone 6.24.1-1	49

References

https://www.bitdefender.com/support/security-advisories/improper-access-control-vulnerability-patchesupdate-api-va-9825