CVE-2006-2478: Medium severity Bitrix Bitrix Site Manager vulnerability
Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified backurl during a HTTP POST request. NOTE: this issue has been referred to as "cross-site scripting," but that is inconsistent with the common use of the term.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2478?
CVE-2006-2478 is considered a moderate severity vulnerability as it allows remote attackers to redirect users to potentially malicious websites.
How do I fix CVE-2006-2478?
To fix CVE-2006-2478, you should upgrade to the latest version of Bitrix Site Manager that is not affected by this vulnerability.
What versions of Bitrix Site Manager are affected by CVE-2006-2478?
CVE-2006-2478 affects Bitrix Site Manager versions 4.0.0 to 4.1.0 inclusive.
What kind of attacks can CVE-2006-2478 enable?
CVE-2006-2478 could enable phishing attacks by redirecting users to malicious websites.
Is CVE-2006-2478 considered a cross-site scripting vulnerability?
No, CVE-2006-2478 is not classified as cross-site scripting despite some references to it as such.