CVE-2021-3823: Path traversal vulnerability in Bitdefender GravitZone Update Server in relay mode

Q: What is CVE-2021-3823?

CVE-2021-3823 is an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in the UpdateServer component of Bitdefender GravityZone.

Q: How severe is CVE-2021-3823?

CVE-2021-3823 has a severity rating of 9.8 (Critical).

Q: Which software versions are affected by CVE-2021-3823?

Bitdefender GravityZone versions prior to 3.3.8.249 are affected by CVE-2021-3823.

Q: How can an attacker exploit CVE-2021-3823?

An attacker can exploit CVE-2021-3823 by executing arbitrary code on vulnerable instances of Bitdefender GravityZone.

Q: How can I fix CVE-2021-3823?

To fix CVE-2021-3823, update Bitdefender GravityZone to version 3.3.8.249 or later.

Published Oct 28, 2021

Updated

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects: Bitdefender GravityZone versions prior to 3.3.8.249.

Affected Software

1 affected component

Bitdefender GravityZone<3.3.8.249

Remediation

Information

An automatic update to Bitdefender GravityZone Update Server to version 3.3.8.249 fixes the issue.

Event History

Oct 28, 2021

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-3823?

CVE-2021-3823 is an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in the UpdateServer component of Bitdefender GravityZone.

How severe is CVE-2021-3823?

CVE-2021-3823 has a severity rating of 9.8 (Critical).

Which software versions are affected by CVE-2021-3823?