CVE-2021-3554: Improper Access Control vulnerability in the patchesUpdate API
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-3554?
CVE-2021-3554 is an Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux.
Which software versions are affected by CVE-2021-3554?
Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390 and between 7.0.0.00 and 7.1.2.33 are affected by CVE-2021-3554.
What is the severity of CVE-2021-3554?
CVE-2021-3554 has a severity rating of critical with a value of 10.
How can an attacker exploit CVE-2021-3554?
An attacker can exploit CVE-2021-3554 by manipulating the remote address used for pulling patches through the patchesUpdate API.
Is there a fix for CVE-2021-3554?
Yes, updating to a version of Bitdefender Endpoint Security Tools for Linux that is not affected by CVE-2021-3554 will fix the vulnerability.