PT-2014-3202 · Bitrix+1 · Bitrix Site Manager+1

Publicado 2014-05-30 · Atualizado 2014-06-26 · CVE-2013-6788

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bitrix Site Manager versions prior to 14.0.1

Description The issue allows remote attackers to bypass authentication via a brute force attack by guessing the BITRIX SM SALE UID cookie value, which uses sequential values.

Recommendations For versions prior to 14.0.1, update to version 14.0.1 or later to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-6788

Produtos afetados

Bitrix

Bitrix Site Manager

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-6788 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6788 · Nota
• https://htbridge.com/advisory/HTB23183 · Nota
• http://securityfocus.com/bid/63606 · Nota
• http://secunia.com/advisories/56033 · Nota
• http://bitrixsoft.com/products/cms/versions.php?module=sale · Aviso do Fabricante