Vulnerability · Published Oct 18, 2024 · Assigned by Bitdefender
CVE-2023-49567Insecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239)
High 8.6
In plain English
A high-severity improper certificate validation in Total Security from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product trusts certificates that are issued using the MD5 and SHA1 collision hash functions which allow attackers to create rogue certificates that appear legitimate.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | Total Security | 0 – before 27.0.25.115 |
Weakness: CWE-295 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N