title: Improper Access Control vulnerability in the patchesUpdate API
description: Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
problem types: CWE-284 Improper Access Control
affected:
{
product: Endpoint Security Tools for Linux
vendor: Bitdefender
versions:
lessThan: 6.6.27.390, status: affected, version: unspecified, versionType: custom
lessThan: 7.1.2.33, status: affected, version: unspecified, versionType: custom
}
{
product: Unified Endpoint
vendor: Bitdefender
versions:
lessThan: 6.2.21.160, status: affected, version: unspecified, versionType: custom
}
{
product: GravityZone
vendor: Bitdefender
versions:
lessThan: 6.24.1-1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
workarounds: An automatic update to version 6.6.27.390 fixes the issue.