CVE-2020-15297 Server-side request forgery in Bitdefender Update Server
An unprivileged attacker can bypass mitigations and interact with network hosts via insufficient validation in Bitdefender Update Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15297?
CVE-2020-15297 is a high-severity server-side request forgery vulnerability in Bitdefender Update Server, published on 9 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the in-place mitigations and interact with hosts on the network. This issue affects: Bitdefender Update Server versions prior to 6.6.20.294.
Weakness: CWE-918
Which versions are affected by CVE-2020-15297?
It affects 1 product.
Products include Bitdefender Update Server.
How do I fix CVE-2020-15297?
No fix has been published for CVE-2020-15297 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-15297 being exploited?
There is no known exploitation of CVE-2020-15297 in the wild and no public exploit code.
Other vulnerabilities in Bitdefender Update Server
Sources
Also known as GHSA-hhwp-8mhp-w9rv.