cve-2023-6154
Vulnerability from cvelistv5
Published
2024-04-01 10:06
Modified
2024-08-12 18:40
Severity ?
EPSS score ?
Summary
Local privilege escalation in Bitdefender Total Security (VA-11168)
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:21:17.586Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://bitdefender.com/support/security-advisories/local-privilege-escalation-in-bitdefender-total-security-va-11168/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:bitdefender:total_security:27.0.25.114:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "total_security",
"vendor": "bitdefender",
"versions": [
{
"status": "affected",
"version": "27.0.25.114"
}
]
},
{
"cpes": [
"cpe:2.3:a:bitdefender:internet_security:27.0.25.114:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "internet_security",
"vendor": "bitdefender",
"versions": [
{
"status": "affected",
"version": "27.0.25.114"
}
]
},
{
"cpes": [
"cpe:2.3:a:bitdefender:antivirus_plus:27.0.25.114:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "antivirus_plus",
"vendor": "bitdefender",
"versions": [
{
"status": "affected",
"version": "27.0.25.114"
}
]
},
{
"cpes": [
"cpe:2.3:a:bitdefender:antivirus:27.0.25.114:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "antivirus",
"vendor": "bitdefender",
"versions": [
{
"status": "affected",
"version": "27.0.25.114"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-02T15:38:45.661553Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-12T18:40:14.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Total Security",
"vendor": "Bitdefender",
"versions": [
{
"status": "affected",
"version": "27.0.25.114"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Internet Security",
"vendor": "Bitdefender",
"versions": [
{
"status": "affected",
"version": "27.0.25.114"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Antivirus Plus",
"vendor": "Bitdefender",
"versions": [
{
"status": "affected",
"version": "27.0.25.114"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Antivirus Free",
"vendor": "Bitdefender",
"versions": [
{
"status": "affected",
"version": "27.0.25.114"
}
]
}
],
"datePublic": "2024-04-01T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product\u0027s expected behavior and potentially load a third-party library upon execution. This issue affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus Plus: 27.0.25.114; Antivirus Free: 27.0.25.114."
}
],
"value": "A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product\u0027s expected behavior and potentially load a third-party library upon execution. This issue affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus Plus: 27.0.25.114; Antivirus Free: 27.0.25.114."
}
],
"impacts": [
{
"capecId": "CAPEC-203",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-203 Manipulate Registry Information"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-15",
"description": "CWE-15: External Control of System or Configuration Setting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-01T10:06:57.864Z",
"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"shortName": "Bitdefender"
},
"references": [
{
"url": "https://bitdefender.com/support/security-advisories/local-privilege-escalation-in-bitdefender-total-security-va-11168/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An automatic update to version\u0026nbsp;27.0.25.115 fixes the issue."
}
],
"value": "An automatic update to version\u00a027.0.25.115 fixes the issue."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Local privilege escalation in Bitdefender Total Security (VA-11168)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"assignerShortName": "Bitdefender",
"cveId": "CVE-2023-6154",
"datePublished": "2024-04-01T10:06:57.864Z",
"dateReserved": "2023-11-15T13:17:52.814Z",
"dateUpdated": "2024-08-12T18:40:14.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-6154\",\"sourceIdentifier\":\"cve-requests@bitdefender.com\",\"published\":\"2024-04-01T11:15:52.437\",\"lastModified\":\"2024-04-01T12:49:00.877\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product\u0027s expected behavior and potentially load a third-party library upon execution. This issue affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus Plus: 27.0.25.114; Antivirus Free: 27.0.25.114.\"},{\"lang\":\"es\",\"value\":\"Un problema de configuraci\u00f3n en seccenter.exe tal como se usa en Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free permite a un atacante cambiar el comportamiento esperado del producto y potencialmente cargar una librer\u00eda de terceros durante la ejecuci\u00f3n. Este problema afecta a Total Security: 27.0.25.114; Seguridad de Internet: 27.0.25.114; Antivirus Plus: 27.0.25.114; Antivirus gratuito: 27.0.25.114.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve-requests@bitdefender.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"cve-requests@bitdefender.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-15\"}]}],\"references\":[{\"url\":\"https://bitdefender.com/support/security-advisories/local-privilege-escalation-in-bitdefender-total-security-va-11168/\",\"source\":\"cve-requests@bitdefender.com\"}]}}"
}
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.