CVE-2006-2476: Medium severity Bitrix Bitrix Site Manager vulnerability
Published May 19, 2006
·Updated
Bitrix Site Manager 4.1.x stores updater.log under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.
Affected Software
9 affected components
Bitrix Bitrix Site Manager<=4.1.0
Bitrix Bitrix Site Manager=4.0.0
Bitrix Bitrix Site Manager=4.0.2
Bitrix Bitrix Site Manager=4.0.3
Bitrix Bitrix Site Manager=4.0.4
Bitrix Bitrix Site Manager=4.0.5
Bitrix Bitrix Site Manager=4.0.6
Bitrix Bitrix Site Manager=4.0.7
Bitrix Bitrix Site Manager=4.0.8
Event History
May 19, 2006
CVE Published
05:02 PM
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-2476?
CVE-2006-2476 is considered a medium severity vulnerability due to the potential exposure of sensitive information.
2
How do I fix CVE-2006-2476?
To fix CVE-2006-2476, ensure that the updater.log file is stored outside of the web document root and restrict access to it.
3
What versions of Bitrix Site Manager are affected by CVE-2006-2476?
CVE-2006-2476 affects multiple versions of Bitrix Site Manager up to and including 4.1.x.
4
What type of information can be exposed by CVE-2006-2476?
CVE-2006-2476 can expose sensitive information logged in the updater.log file to unauthorized users.
5
Are there any known exploits for CVE-2006-2476?
Yes, there are known instances where attackers have exploited CVE-2006-2476 to gain access to sensitive information.