CVE-2021-3960CWE-22

Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-10146)

High · published December 16, 2021

CVSS v3.1
7.1
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects Bitdefender GravityZone versions prior to 3.3.8.272

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00319 · 23.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2021-12-16T14:40Z
EPSS history
Timeline
  • 16 DEC 14:40Z
    Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-10146)
    cvelistv5