CVE-2006-2479

Published: May 19, 2006Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site.

Affected (9)

Products: Bitrix: Bitrix Site Manager

Bitrix

1 product

Bitrix Site Manager

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Bitrix Bitrix Site Manager	Version 4.0.0
Bitrix Bitrix Site Manager	Version 4.0.2
Bitrix Bitrix Site Manager	Version 4.0.3
Bitrix Bitrix Site Manager	Version 4.0.4
Bitrix Bitrix Site Manager	Version 4.0.5
Bitrix Bitrix Site Manager	Version 4.0.6
Bitrix Bitrix Site Manager	Version 4.0.7
Bitrix Bitrix Site Manager	Version 4.0.8
Bitrix Bitrix Site Manager	Version 4.1.0