Vulnerability Name: | CCN-94644 | ||||||
Published: | 2014-07-16 | ||||||
Updated: | 2014-07-16 | ||||||
Summary: | Bitdefender GravityZone could allow a remote attacker to bypass security restrictions, caused by missing authentication checks for /webservice/CORE/downloadSignedCsr. An attacker could exploit this vulnerability to upload arbitrary certificates and launch further attacks on the system. | ||||||
CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||
CVSS v2 Severity: | 5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N) 3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||
Vulnerability Consequences: | Bypass Security | ||||||
References: | Source: CCN Type: BugTraq Mailing List, Wed Jul 16 2014 - 07:19:33 CDT SEC Consult SA-20140716-3 :: Multiple critical vulnerabilities in Bitdefender GravityZone Source: CCN Type: Bitdefender Web site GravityZone Source: CCN Type: BID-68669 Bitdefender GravityZone Authentication Bypass and Unauthorized Access Vulnerabilities Source: XF Type: UNKNOWN gravityzone-downloadsignedcsr-sec-bypass(94644) Source: CCN Type: Packet Storm Security [07-16-2014] Bitdefender GravityZone File Disclosure / Missing Authentication Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [07-16-2014] | ||||||
Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
BACK |