Lucene search
HistoryMay 19, 2006 - 5:02 p.m.
CVE-2006-2479
bitrix site manager
update functionality
vulnerability
cve-2006-2479
dns cache poisoning
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.2 High
AI Score
Confidence
High
0.012 Low
EPSS
Percentile
85.5%
The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site.
Affected configurations
Node
bitrixbitrix_site_managerMatch4.0.0
ORbitrixbitrix_site_managerMatch4.0.2
ORbitrixbitrix_site_managerMatch4.0.3
ORbitrixbitrix_site_managerMatch4.0.4
ORbitrixbitrix_site_managerMatch4.0.5
ORbitrixbitrix_site_managerMatch4.0.6
ORbitrixbitrix_site_managerMatch4.0.7
ORbitrixbitrix_site_managerMatch4.0.8
ORbitrixbitrix_site_managerMatch4.1.0
Related
cvelist
cvelist
CVE-2006-2479
2006-05-19 17:00:00
nvd
nvd
CVE-2006-2479
2006-05-19 17:02:00
prion
prion
Design/Logic Flaw
2006-05-19 17:02:00
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.2 High
AI Score
Confidence
High
0.012 Low
EPSS
Percentile
85.5%
Related for CVE-2006-2479