CVE-2021-3554: Improper Access Control vulnerability in the patchesUpdate API
First published: Wed Nov 24 2021(Updated: )
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
Credit: cve-requests@bitdefender.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bitdefender Endpoint Security Tools | <6.6.27.390 | |
| Bitdefender Endpoint Security Tools | <6.6.27.390 | |
| Bitdefender Endpoint Security Tools | >=7.0.0.00<7.1.2.33 | |
| Bitdefender GravityZone | <6.24.1-1 | |
| Bitdefender GravityZone | =6.24.1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-3554?
CVE-2021-3554 is an Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux.
Which software versions are affected by CVE-2021-3554?
Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390 and between 7.0.0.00 and 7.1.2.33 are affected by CVE-2021-3554.
What is the severity of CVE-2021-3554?
CVE-2021-3554 has a severity rating of critical with a value of 10.
How can an attacker exploit CVE-2021-3554?
An attacker can exploit CVE-2021-3554 by manipulating the remote address used for pulling patches through the patchesUpdate API.
Is there a fix for CVE-2021-3554?
Yes, updating to a version of Bitdefender Endpoint Security Tools for Linux that is not affected by CVE-2021-3554 will fix the vulnerability.
- collector/nvd-index
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/references
- agent/title
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/type
- vendor/bitdefender
- canonical/bitdefender endpoint security tools
- version/bitdefender endpoint security tools/7.0.0.00
- canonical/bitdefender gravityzone
- version/bitdefender gravityzone/6.24.1-1