CVE-2023-49567 HIGH

CVE-2023-49567: Insecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239)

Vendor Bitdefender
Product Total Security
Weakness CWE-295
Published October 18, 2024
Last update October 18, 2024
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

What the vulnerability does

01Description

A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product trusts certificates that are issued using the MD5 and SHA1 collision hash functions which allow attackers to create rogue certificates that appear legitimate.

Key dates

02Disclosure timeline

October 18, 2024 CVE published
October 18, 2024 Record updated