PT-2021-20950 · Bitdefender · Bitdefender Gravityzone+1

Published 2021-11-24 · Updated 2021-12-01 · CVE-2021-3552

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390 Bitdefender Endpoint Security Tools versions prior to 7.1.2.33 Bitdefender GravityZone version 6.24.1-1

Description: A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component allows an attacker to proxy requests to the relay server.

Recommendations: For Bitdefender Endpoint Security Tools versions prior to 6.6.27.390, update to version 6.6.27.390 or later. For Bitdefender Endpoint Security Tools versions prior to 7.1.2.33, update to version 7.1.2.33 or later. For Bitdefender GravityZone version 6.24.1-1, consider disabling the EPPUpdateService component until a patch is available.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-3552

Affected Products

Bitdefender Endpoint Security Tools

Bitdefender Gravityzone

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-3552 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3552 · Vendor Advisory
• https://bitdefender.com/support/security-advisories/insufficient-validation-regular-expression-eppupdateservice-config-file-va-9825 · Note
• https://t.me/cvenotify/23732 · Telegram Post
• https://t.me/cibsecurity/32958 · Telegram Post