Vulnerability · Published Dec 16, 2021 · Assigned by Bitdefender
CVE-2021-3960Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-10146)
High 7.1
In plain English
A high-severity path traversal in GravityZone from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 75.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects Bitdefender GravityZone versions prior to 3.3.8.272
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | GravityZone | unspecified – before 3.3.8.272 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N