Vulnerability · Published Nov 24, 2021 · Assigned by Bitdefender
CVE-2021-3554Improper Access Control vulnerability in the patchesUpdate API
Critical 9.0
In plain English
A critical-severity improper access control in Endpoint Security Tools for Linux from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Official description
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | Endpoint Security Tools for Linux | unspecified – before 6.6.27.390unspecified – before 7.1.2.33 |
| Bitdefender | Unified Endpoint | unspecified – before 6.2.21.160 |
| Bitdefender | GravityZone | unspecified – before 6.24.1-1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H