← Back

CVE-2021-3553

nvd nist
Published: Nov 24, 2021Modified: Nov 21, 2024

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.

Affected (4)

Bitdefender
2 products
Endpoint Security Tools
Gravityzone
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Bitdefender
Endpoint Security Tools
From 6.6.27.0 to 6.6.27.390
Endpoint Security Tools
From 7.0.0.00 to 7.1.2.33
Endpoint Security Tools
Before 6.2.21.160
Gravityzone
Version 6.24.1-1

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (3)

Source: cve-requests@bitdefender.com
Broken Link
Source: nvd@nist.gov
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link

Timeline

No history available yet.