Vulnerability in Bitrix Site Manager
CVE-2006-2478
Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified back_url during a HTTP POST request. NOTE: this issue has been referred to as "cross-site scripting," but that is inconsistent with the common use of the term.
EPSS: 0.016 (73.9th percentile) — read the EPSS interpretation.
Affected products
- Bitrix Bitrix_site_manager — versions 4.0.0, 4.0.2, 4.0.3
- N/a — versions n/a
References
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (Exploit, vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_SREASON, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)