CVE-2020-15732 Security feature bypass in Antivirus Plus
Attackers can bypass HSTS checks in Bitdefender's Online Threat Prevention module due to improper certificate validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-15732?
CVE-2020-15732 is a medium-severity vulnerability in Bitdefender Antivirus Plus, published on 22 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacker to potentially bypass HTTP Strict Transport Security (HSTS) checks. This issue affects: Bitdefender Total Security versions prior to 25.0.7.29. Bitdefender Internet Security versions prior to 25.0.7.29. Bitdefender Antivirus Plus versions prior to 25.0.7.29.
Weakness: CWE-295
Which versions are affected by CVE-2020-15732?
It affects 3 products.
Products include Bitdefender Antivirus Plus, Bitdefender Internet Security, Bitdefender Total Security.
How do I fix CVE-2020-15732?
No fix has been published for CVE-2020-15732 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-15732 being exploited?
There is no known exploitation of CVE-2020-15732 in the wild and no public exploit code.
Other vulnerabilities in Bitdefender Antivirus Plus
- CVE-2020-8107 Process Control vulnerability in Bitdefender Antivirus Plus
- CVE-2021-4199 Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017)
- CVE-2022-0357 Improper Quoting Path Issue in Bitdefender Total Security
- CVE-2019-14242 Code injection in n/a
- CVE-2017-6186 Code injection in n/a
Sources
Also known as GHSA-gm3w-m9x6-x5vq.