Medium severity · published Apr 12, 2021
CVE-2020-15734
An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same directory or sub-directories. This issue affects: Bitdefender Safepay versions prior to 25.0.7.29.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Safepay · Bitdefender
before 25.0.7.29 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15734
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15734
Vendor Advisory
https://www.bitdefender.com/support/security-advisories/origin-policy-vulnerability-bitdefender-safepay/
More from Safepay
8.8
CVE-2019-6738
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34
8.8
CVE-2019-6737
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34
8.8
CVE-2019-6736
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34