HIGH🇵🇱 Wersja polska

CVE-2023-49567

CVSS 8.6v4.0pub. 2024-10-18upd. 2024-10-22

A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product trusts certificates that are issued using the MD5 and SHA1 collision hash functions which allow attackers to create rogue certificates that appear legitimate.

CVSS Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Bitdefender Total Security

    APP
    Bitdefender
    < 27.0.25.115
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2007-5775CRITICAL9.8PL ✓same product

Nieokreślona podatność RCE w produktach Bitdefender

CVE-2026-6851HIGH7.0PL ✓same product

Bitdefender: privilege escalation przez symbolic link w module File Shredder

CVE-2025-7073HIGH8.8same product

A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows ...

CVE-2023-49570HIGH8.6same product

A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the softw...

CVE-2023-6055HIGH8.6same product

A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the softw...