CVE Feed

    Dashboard / CVE / CVE-2023-6055

    CVE-2023-6055

    A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates. Specifically, if a site certificate lacks the "Server Authentication" specification in the Extended Key Usage extension, the product does not verify the certificate's compliance with the site, deeming such certificates as valid. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website.

    Published:Oct 18, 2024
    Last Modified:Oct 22, 2024
    EPS:Oct 18, 2024
    EPSS Score:0.00049
    CVSS Score:7.4

    Affected Products

    Vendor
    Bitdefender
    Product
    Total Security

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2026-6851 (CVSS 7) — An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as…
    CVE-2025-7073 (CVSS 8.8) — A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows …
    CVE-2023-49570 (CVSS 8.6) — A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the softw…
    CVE-2023-49567 (CVSS 8.6) — A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the p…
    CVE-2023-6058 (CVSS 8.6) — A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises w…
    CVE-2023-6057 (CVSS 8.6) — A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in…
    CVE-2023-6056 (CVSS 8.6) — A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in…
    CVE-2023-6154 (CVSS 7.8) — A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Sec…
    CVE-2022-0357 (CVSS 6.7) — Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Securit…
    CVE-2021-4199 (CVSS 7.8) — Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.e…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High