PT-2014-3202 · Bitrix+1 · Bitrix Site Manager+1

Published 2014-05-30 · Updated 2014-06-26 · CVE-2013-6788

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bitrix Site Manager versions prior to 14.0.1

Description The issue allows remote attackers to bypass authentication via a brute force attack by guessing the BITRIX SM SALE UID cookie value, which uses sequential values.

Recommendations For versions prior to 14.0.1, update to version 14.0.1 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-6788

Affected Products

Bitrix

Bitrix Site Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-6788 · Security Note
• http://bitrixsoft.com/products/cms/versions.php?module=sale · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6788 · Note
• https://htbridge.com/advisory/HTB23183 · Note
• http://securityfocus.com/bid/63606 · Note
• http://secunia.com/advisories/56033 · Note