CVE-2023-6056

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. The product is found to trust certificates signed with the RIPEMD-160 hashing algorithm without proper validation, allowing an attacker to establish MITM SSL connections to arbitrary sites.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Oct 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-60577.4A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certifiCVE-2023-60586.8A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a conneCVE-2023-60626.5An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus applicationCVE-2023-60637.5The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leaCVE-2023-60647.5The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive informatCVE-2023-60655.3The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actoCVE-2023-60664.3The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callbCVE-2023-60675.4The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting thCVE-2023-60683.1On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrectCVE-2023-60698.8Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.CVE-2023-60704.3A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary coCVE-2023-60717.2An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator
CVE-2023-6056: High severity, CVSS 7.4 | Vulnix