Lucene search

BitdefenderCVE-2022-3369

HistoryNov 01, 2022 - 8:15 a.m.

CVE-2022-3369

2022-11-0108:15:10

CWE-269

Bitdefender

web.nvd.nist.gov

cve-2022-3369

improper access control

bdservicehost.exe

bitdefender engines

windows

registry symlink

vulnerability

CVSS3

8.6

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

20.2%

JSON

An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender Engines versions prior to 7.92659. It also affects Bitdefender Antivirus Free, Bitdefender Antivirus Plus, Bitdefender Internet Security, Bitdefender Total Security, as well as Bitdefender Endpoint Security Tools for Windows with engine versions prior to 7.92659.

Affected configurations

Nvd

Node

bitdefenderenginesRange<7.92659

VendorProductVersionCPE
bitdefenderengines*cpe:2.3:a:bitdefender:engines:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bitdefender	engines	*	cpe:2.3:a:bitdefender:engines::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Engines",
    "vendor": "Bitdefender",
    "versions": [
      {
        "lessThan": "7.92659",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.bitdefender.com/support/security-advisories/improper-handling-of-registry-symbolic-links-in-bitdefender-engines-va-10562

Social References

CVSS3

8.6

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

20.2%

JSON

Related for CVE-2022-3369