Vulnerability · Published Nov 1, 2022 · Assigned by Bitdefender
CVE-2022-3369Improper handling of registry symbolic links in Bitdefender Engines
High 8.6
In plain English
A high-severity privilege mismanagement in Engines from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender Engines versions prior to 7.92659. It also affects Bitdefender Antivirus Free, Bitdefender Antivirus Plus, Bitdefender Internet Security, Bitdefender Total Security, as well as Bitdefender Endpoint Security Tools for Windows with engine versions prior to 7.92659.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | Engines | unspecified – before 7.92659 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H