Vulnerability · Published Nov 24, 2021 · Assigned by Bitdefender
CVE-2021-3553Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825)
Medium 5.3
In plain English
A medium-severity server-side request forgery in Endpoint Security Tools from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Official description
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | Endpoint Security Tools | unspecified – before 6.6.27.390unspecified – before 7.1.2.33 |
| Bitdefender | Unified Endpoint for Linux | unspecified – before 6.2.21.160 |
| Bitdefender | GravityZone | unspecified – before 6.24.1-1 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N