PT-2024-13750 · Bitdefender · Bitdefender Total Security
Published
2024-10-18
·
Updated
2024-10-22
·
CVE-2023-49570
CVSS v4.0
8.6
High
| Vector | AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N |
Name of the Vulnerable Software and Affected Versions
Bitdefender Total Security versions prior to the latest version
Description
A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant to be an "End Entity”. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website.
Recommendations
Update to the latest version to mitigate risks.
As a temporary workaround, consider restricting the use of the HTTPS scanning functionality until a patch is available.
Ensure your software is updated to the latest version to mitigate risks.
For detailed remediation steps, visit the advisory here: https://t.co/MwoBACVbq6
Note: The link provided is not accessible in this format, it is recommended to check the official Bitdefender website for the latest remediation steps.
Fix
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bitdefender Total Security