CVE-2021-3553

Name of the Vulnerable Software and Affected Versions Bitdefender Endpoint Security Tools versions prior to 6.6.27.390 Bitdefender Endpoint Security Tools versions prior to 7.1.2.33 Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160 Bitdefender GravityZone versions prior to 6.24.1-1

Description A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue is related to insufficient validation of incoming requests, which can allow a remote attacker to disclose protected information.

Recommendations For Bitdefender Endpoint Security Tools versions prior to 6.6.27.390, update to version 6.6.27.390 or later. For Bitdefender Endpoint Security Tools versions prior to 7.1.2.33, update to version 7.1.2.33 or later. For Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160, update to version 6.2.21.160 or later. For Bitdefender GravityZone versions prior to 6.24.1-1, update to version 6.24.1-1 or later. As a temporary workaround, consider restricting access to the EPPUpdateService to minimize the risk of exploitation.