Vulnerability · Published Nov 9, 2020 · Assigned by Bitdefender
CVE-2020-15297
High 7.1
In plain English
A high-severity server-side request forgery in Bitdefender Update Server from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.9%top 41.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the in-place mitigations and interact with hosts on the network. This issue affects: Bitdefender Update Server versions prior to 6.6.20.294.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | Bitdefender Update Server | unspecified – before 6.6.20.294 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N