CVE-2025-5317CWE-862broken-access-control

CVE-2025-5317

Medium · published November 11, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
1.3
In the wild
Unconfirmed
What it is

An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the application directory (/Applications/Endpoint Security for Mac.app/) and the related directories within /Library/Bitdefender/AVP without needing the uninstall password.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00112 · 1.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-11-11T13:15Z
Affected products (1)
ProductVersionsFixed in
bitdefender/endpoint_security< 7.20.52.2000877.20.52.200087
References (1)
https://www.bitdefender.com/support/security-advisories/improper-access-restriction-to-critical-folder-in-bitdefender-endpoint-security-tools-for-mac/ · [email protected]
EPSS history
Timeline
  • 11 NOV 08:02Z
    Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac
    cvelistv5