CVE-2025-5317

An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the application directory (/Applications/Endpoint Security for Mac.app/) and the related directories within /Library/Bitdefender/AVP without needing the uninstall password.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.bitdefender.com/support/security-advisories/improper-access-restriction-to-critical-folder-in-bitdefender-endpoint-security-tools-for-mac/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bitdefender:endpoint_security:*:*:*:*:*:macos:*:*

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una restricción de acceso inadecuada a una carpeta en Bitdefender Herramientas de Seguridad de punto final para Mac (BEST) anterior a 7.20.52.200087 permite a usuarios locales con privilegios administrativos eludir la protección de contraseña de desinstalación configurada. Un usuario no autorizado con privilegios sudo puede eliminar manualmente el directorio de la aplicación (/Applications/Endpoint Security for Mac.app/) y los directorios relacionados dentro de /Library/Bitdefender/AVP sin necesidad de la contraseña de desinstalación.

Information

Published : 2025-11-11 08:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-5317

Mitre link : CVE-2025-5317

CVE.ORG link : CVE-2025-5317

JSON object : View

Products Affected

bitdefender

endpoint_security

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-5317", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5317", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T14:55:16.722643Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-requests@bitdefender.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-requests@bitdefender.com", "affectedData": [{"vendor": "Bitdefender", "product": "Endpoint Security Tools for Mac", "versions": [{"status": "affected", "version": "0", "lessThan": "7.20.52.200087", "versionType": "custom"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}]}], "published": "2025-11-11T08:15:34.113", "references": [{"url": "https://www.bitdefender.com/support/security-advisories/improper-access-restriction-to-critical-folder-in-bitdefender-endpoint-security-tools-for-mac/", "tags": ["Vendor Advisory"], "source": "cve-requests@bitdefender.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve-requests@bitdefender.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the application directory (/Applications/Endpoint Security for Mac.app/) and the related directories within /Library/Bitdefender/AVP without needing the uninstall password."}, {"lang": "es", "value": "Una restricci\u00f3n de acceso inadecuada a una carpeta en Bitdefender Herramientas de Seguridad de punto final para Mac (BEST) anterior a 7.20.52.200087 permite a usuarios locales con privilegios administrativos eludir la protecci\u00f3n de contrase\u00f1a de desinstalaci\u00f3n configurada. Un usuario no autorizado con privilegios sudo puede eliminar manualmente el directorio de la aplicaci\u00f3n (/Applications/Endpoint Security for Mac.app/) y los directorios relacionados dentro de /Library/Bitdefender/AVP sin necesidad de la contrase\u00f1a de desinstalaci\u00f3n."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bitdefender:endpoint_security:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "5C09E9F4-6E6F-429B-A4C0-021035BDC55B", "versionEndExcluding": "7.20.52.200087"}], "operator": "OR"}]}], "sourceIdentifier": "cve-requests@bitdefender.com"}