Vulnerability Details CVE-2006-2479
The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 71.6%
CVSS Severity
CVSS v2 Score 5.0
References
- http://securityreason.com/securityalert/918
- http://securitytracker.com/id?1016121
- http://www.securityfocus.com/archive/1/434367/100/0/threaded
- http://www.vupen.com/english/advisories/2006/1858
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26542
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26548
- http://securityreason.com/securityalert/918
- http://securitytracker.com/id?1016121
- http://www.securityfocus.com/archive/1/434367/100/0/threaded
- http://www.vupen.com/english/advisories/2006/1858
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26542
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26548
Products affected by CVE-2006-2479
-
cpe:2.3:a:bitrix:bitrix_site_manager:4.0.0
-
cpe:2.3:a:bitrix:bitrix_site_manager:4.0.2
-
cpe:2.3:a:bitrix:bitrix_site_manager:4.0.3
-
cpe:2.3:a:bitrix:bitrix_site_manager:4.0.4
-
cpe:2.3:a:bitrix:bitrix_site_manager:4.0.5
-
cpe:2.3:a:bitrix:bitrix_site_manager:4.0.6
-
cpe:2.3:a:bitrix:bitrix_site_manager:4.0.7
-
cpe:2.3:a:bitrix:bitrix_site_manager:4.0.8
-
cpe:2.3:a:bitrix:bitrix_site_manager:4.1.0