CVE-2023-6058 HTTPS Certificate Validation Issue in Bitdefender Safepay (VA-11167)

High 8.6 Published 18 Oct 2024 Updated 18 Oct 2024

Attackers can intercept secure traffic via MITM if users add untrusted sites to exceptions, bypassing certificate validation in Bitdefender Safepay.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-6058?

CVE-2023-6058 is a high-severity vulnerability in Bitdefender Total Security, published on 18 Oct 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an untrusted server certificate but allows the user to add the site to exceptions, resulting in the product trusting the certificate for subsequent HTTPS scans. This vulnerability allows an attacker to perform a Man-in-the-Middle (MITM) attack by using a self-signed certificate, which the product will trust after the site has been added to exceptions. This can lead to the interception and potential alteration of secure communications.

Weakness: CWE-295

Which versions are affected by CVE-2023-6058?

It affects 1 product.

Products include Bitdefender Total Security.

How do I fix CVE-2023-6058?

No fix has been published for CVE-2023-6058 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-6058 being exploited?

There is no known exploitation of CVE-2023-6058 in the wild and no public exploit code.

Sources

Also known as GHSA-h64p-h4x7-h6r6.