Vulnerabilities

TI-2021-02857 CVE-2021-3960 · GHSA-h2c3-ph7g-cmvq

Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-10146)

LOW 34

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00319 Published 2021-12-16 Fixed in 3.3.8.272 CWE-22

TI-2021-02856 CVE-2021-3959 · GHSA-f622-26hm-xgj8

Server-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145)

LOW 36

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01743 Published 2021-12-16 Fixed in 3.3.8.272 CWE-918

Vulnerabilities

Filters

Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-10146)

Server-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145)