Bitdefender Update Server vulnerabilities

3 CVEs affecting Bitdefender Update Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-0677, published 2022-04-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-0396, published 2008-01-23. High severity, CVSS 7.8. EPSS: 8.5% chance of exploitation in the next 30 days. Directory traversal vulnerability in BitDefender Update Server (http.exe), as used in BitDefender products including Security for Fileservers and Enterprise Manager (BDEM), allows remote attackers to…
CVE-2022-0677, published 2022-04-07. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an…
CVE-2020-15297, published 2020-11-09. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the…