CVE-2021-3553: Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825)
First published: Wed Nov 24 2021(Updated: )
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
Credit: cve-requests@bitdefender.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bitdefender Endpoint Security Tools | <6.2.21.160 | |
| Bitdefender Endpoint Security Tools | >=6.6.27.0<6.6.27.390 | |
| Bitdefender Endpoint Security Tools | >=7.0.0.00<7.1.2.33 | |
| Bitdefender GravityZone | =6.24.1-1 |
Remedy
An automatic update to version 6.6.27.390 fixes the issue.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-3553?
CVE-2021-3553 is a Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools.
How does the SSRF vulnerability in Bitdefender Endpoint Security Tools work?
The SSRF vulnerability allows an attacker to use the Endpoint Protection relay as a proxy for any remote host.
Which versions of Bitdefender Endpoint Security Tools are affected by CVE-2021-3553?
Bitdefender Endpoint Security Tools versions prior to 6.6.27.390 are affected.
What is the severity of CVE-2021-3553?
The severity of CVE-2021-3553 is high with a CVSS score of 7.5.
How can I fix CVE-2021-3553?
To fix CVE-2021-3553, update Bitdefender Endpoint Security Tools to version 6.6.27.390 or later.
- agent/references
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/title
- agent/weakness
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/bitdefender
- canonical/bitdefender endpoint security tools
- version/bitdefender endpoint security tools/6.6.27.0
- version/bitdefender endpoint security tools/7.0.0.00
- canonical/bitdefender gravityzone
- version/bitdefender gravityzone/6.24.1-1