PT-2019-12890 · Bitdefender · Bitdefender Box

Publicado 2019-10-31 · Atualizado 2020-08-24 · CVE-2019-12612

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bitdefender BOX versions prior to 2.1.37.37-34

Description An issue was discovered that allows an attacker to pass arbitrary code to the BOX appliance via the web API. To exploit this, an attacker needs presence in the Bitdefender BOX setup network and the BOX must be in setup mode.

Recommendations For versions prior to 2.1.37.37-34, update to version 2.1.37.37-34 or later to resolve the issue. As a temporary workaround, consider restricting access to the web API until a patch is applied.

Correção

Identificadores relacionados

CVE-2019-12612

Produtos afetados

Bitdefender Box

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-12612 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12612 · Aviso do Fabricante
• https://bitdefender.com/support/security-advisories/bitdefender-box-local-code-execution · Aviso do Fabricante