CVE-2023-6056CWE-295

Insecure Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11164)

High · published October 18, 2024

CVSS v4.0
8.6
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. The product is found to trust certificates signed with the RIPEMD-160 hashing algorithm without proper validation, allowing an attacker to establish MITM SSL connections to arbitrary sites.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00214 · 11.2th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2024-10-18T07:31Z
EPSS history
Timeline
  • 18 OCT 07:31Z
    Insecure Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11164)
    cvelistv5