CVE-2023-49567CWE-295

Insecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239)

High · published October 18, 2024

CVSS v4.0
8.6
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product trusts certificates that are issued using the MD5 and SHA1 collision hash functions which allow attackers to create rogue certificates that appear legitimate.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00194 · 8.7th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2024-10-18T07:59Z
EPSS history
Timeline
  • 18 OCT 07:59Z
    Insecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239)
    cvelistv5