PT-2005-2941 · Bitrix+1 · Bitrix Site Manager+1

D_Bug · Publicado 2005-06-15 · Atualizado 2017-07-11 · CVE-2005-1995

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bitrix Site Manager versions 4.0.x

Description The issue allows remote attackers to obtain sensitive information by making a direct request to certain files. Specifically, requests to "subscr form.php" or "dbquery error.php" can reveal the path in an error message.

Recommendations For versions 4.0.x, consider restricting access to the "subscr form.php" and "dbquery error.php" files to minimize the risk of exploitation. As a temporary workaround, disabling error messages that reveal sensitive information can also help mitigate the issue.

Correção

Identificadores relacionados

CVE-2005-1995

Produtos afetados

Bitrix

Bitrix Site Manager

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1995 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1995 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21019 · Nota
• http://osvdb.org/17348 · Correção
• http://osvdb.org/17376 · Correção
• http://marc.info/?l=bugtraq&m=111885652331100&w=2 · Nota