Lucene search

BitdefenderCVE-2020-15297

HistoryNov 09, 2020 - 9:15 a.m.

CVE-2020-15297

2020-11-0909:15:12

CWE-918

Bitdefender

web.nvd.nist.gov

cve-2020-15297

bitdefender

update server

best relay

endpoint security

network security

vulnerability

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

57.3%

JSON

Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the in-place mitigations and interact with hosts on the network. This issue affects: Bitdefender Update Server versions prior to 6.6.20.294.

Affected configurations

Nvd

Node

bitdefenderupdate_serverRange<6.6.20.294

VendorProductVersionCPE
bitdefenderupdate_server*cpe:2.3:a:bitdefender:update_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bitdefender	update_server	*	cpe:2.3:a:bitdefender:update_server::::::::

CNA Affected

[
  {
    "product": "Bitdefender Update Server",
    "vendor": "Bitdefender",
    "versions": [
      {
        "lessThan": "6.6.20.294",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.bitdefender.com/support/security-advisories/server-side-request-forgery-bitdefender-update-server-va-9163/

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

57.3%

JSON

Related for CVE-2020-15297