CVE-2023-49570: Insecure Trust of Basic Constraints certificate in Bitdefender Total Security HTTPS Scanning (VA-11210)
First published: Fri Oct 18 2024(Updated: )
A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant to be an "End Entity”. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website.
Credit: cve-requests@bitdefender.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bitdefender | <27.0.25.115 |
Remedy
An automatic update to product version 27.0.25.115 fixes the issue.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-49570?
CVE-2023-49570 is classified as a high severity vulnerability due to insecure trust in certificate validation.
How do I fix CVE-2023-49570?
To fix CVE-2023-49570, ensure that you update Bitdefender Total Security to the latest version that addresses the vulnerability.
What software versions are affected by CVE-2023-49570?
CVE-2023-49570 affects Bitdefender Total Security versions up to 27.0.25.115.
What is the impact of CVE-2023-49570?
CVE-2023-49570 may allow unauthorized access or exploitation through improper certificate validation.
Is CVE-2023-49570 related to HTTPS scanning?
Yes, CVE-2023-49570 specifically involves a vulnerability in the HTTPS scanning functionality of Bitdefender Total Security.
- agent/remedy
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/bitdefender
- canonical/bitdefender