Vulnerability · Published Jun 22, 2021 · Assigned by Bitdefender

CVE-2020-15732

Medium 6.5

In plain English

A medium-severity improper certificate validation in Antivirus Plus from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 53.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacker to potentially bypass HTTP Strict Transport Security (HSTS) checks. This issue affects: Bitdefender Total Security versions prior to 25.0.7.29. Bitdefender Internet Security versions prior to 25.0.7.29. Bitdefender Antivirus Plus versions prior to 25.0.7.29.

Affected products (as reported)

Vendor	Product	Versions
Bitdefender	Total Security	unspecified – before 25.0.7.29
Bitdefender	Internet Security	unspecified – before 25.0.7.29
Bitdefender	Antivirus Plus	unspecified – before 25.0.7.29

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

https://www.bitdefender.com/support/security-advisories/improper-certificate-validation-bitdefender-total-security-va-8957 x_refsource_MISC