Medium severity5.3NVD Advisory· Published Nov 24, 2021· Updated Jun 17, 2026

CVE-2021-3552

Description

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender GravityZone 6.24.1-1.

Affected products

Bitdefender/Endpoint Security Tools2 versions
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:*range: >=6.6.27.0,<6.6.27.390
- cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:-:*:*range: <6.2.21.160
Bitdefender/Gravityzone3 versions
cpe:2.3:a:bitdefender:gravityzone:6.24.1-1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:bitdefender:gravityzone:6.24.1-1:*:*:*:*:*:*:*
- (no CPE)range: 6.24.1-1
- (no CPE)range: 6.24.1-1
Bitdefender/EPPUpdateServicellm-create
Range: <6.6.27.390, <7.1.2.33
Bitdefender/Bitdefender Endpoint Security Tools for Windowsllm-fuzzy
Range: <6.6.27.390, <7.1.2.33
Bitdefender/Endpoint Security Tools for Maccpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

www.bitdefender.com/support/security-advisories/insufficient-validation-regular-expression-eppupdateservice-config-file-va-9825nvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000