Read the docs
TI-2020-12400 Aliases CVE-2020-15734GHSA-3wf5-983h-ccwq

Same-origin policy vulnerability in Bitdefender Safepay

Priority LOW 24CWE-346Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same directory or sub-directories. This issue affects: Bitdefender Safepay versions prior to 25.0.7.29.

Why it matters now

EPSS 0.00163 5th percentileScored 2026-11-07
Fix Fixed Safepay (Bitdefender): 25.0.7.29

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BitdefenderSafepaybefore 25.0.7.2925.0.7.29Patch availableCNA
  • Safepay VendorBitdefender Affected before 25.0.7.29 Fixed in 25.0.7.29 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bitdefender:safepay:*:*:*:*:*:*:*:*before 25.0.7.29VulnerableBitdefender
  • cpe:2.3:a:bitdefender:safepay:*:*:*:*:*:*:*:* Versions before 25.0.7.29 Vulnerable ·Bitdefender

Remediation

  • Fix · CNA Safepay (Bitdefender) Fixed in 25.0.7.29

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15734
  2. 2026-10-03 Alias added: GHSA-3wf5-983h-ccwq

References

Advisory 1

  • TI-2019-04774 This vulnerability allows remote attackers to execute arbitrary code on vulnerable… CVSS 3.1HIGH 8.8
  • TI-2019-04775 OS command injection in Bitdefender SafePay CVSS 3.1HIGH 8.8
  • TI-2019-04773 OS command injection in Bitdefender SafePay CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences