CVE-2023-49570: Insecure Trust of Basic Constraints certificate in Bitdefender Total Security HTTPS Scanning (VA-11210)
A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant to be an "End Entity”. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49570?
CVE-2023-49570 is classified as a high severity vulnerability due to insecure trust in certificate validation.
How do I fix CVE-2023-49570?
To fix CVE-2023-49570, ensure that you update Bitdefender Total Security to the latest version that addresses the vulnerability.
What software versions are affected by CVE-2023-49570?
CVE-2023-49570 affects Bitdefender Total Security versions up to 27.0.25.115.
What is the impact of CVE-2023-49570?
CVE-2023-49570 may allow unauthorized access or exploitation through improper certificate validation.
Is CVE-2023-49570 related to HTTPS scanning?
Yes, CVE-2023-49570 specifically involves a vulnerability in the HTTPS scanning functionality of Bitdefender Total Security.