CVE-2023-49567: falha de alta gravidade em Bitdefender Total Security
Insecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.2%
A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product trusts certificates that are issued using the MD5 and SHA1 collision hash functions which allow attackers to create rogue certificates that appear legitimate.
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Produtos afetados
Bitdefender · Total SecurityCVEs relacionadas — Bitdefender Total Security
No mesmo produto, das mais perigosas para as menos.
CVE-2021-3576HIGHPrivilege escalation via SeImpersonatePrivilegeEPSS 0.9%CVE-2021-4199HIGHIncorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017)EPSS 0.8%CVE-2021-3579HIGHIncorrect Default Permissions vulnerability in bdservicehost.exe and Vulnerability.Scan.exeEPSS 0.7%CVE-2020-15732MEDIUMCVE-2020-15732EPSS 0.6%CVE-2021-4198MEDIUMmessaging_ipc.dll NULL Pointer Dereference in multiple Bitdefender products (VA-10016)EPSS 0.5%CVE-2020-8107HIGHProcess Control vulnerability in Bitdefender Antivirus PlusEPSS 0.3%