Bitrix Site Manager
Vendor:
First CVE: Jun 15, 2005 · Active for 21 years
7
Total CVEs
More Total CVEs than 83% of tracked products
2.3
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
5.3
Avg CVSS
Higher Avg CVSS than 11% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Bitrix Site Manager over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 15, 2005
21 years ago
Most Recent CVE
May 30, 2014
4,438 days ago
CVE Severity & Scoring
Bitrix Site Manager7 CVEs
86%
14%
All CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown7 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown7 (100.0%)
User Interaction
None0 (0.0%)
Unknown7 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown7 (100.0%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-6788HIGH The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIX_SM_SALE_UID cookie, which makes it easier for remote attackers to guess the co | May 30, 2014 | 7.5 | 19 | NO | NO |
CVE-2005-1995MEDIUM Bitrix Site Manager 4.0.x allows remote attackers to obtain sensitive information via direct request to (1) subscr_form.php or (2) dbquery_error.php, which reveals the path in an e | Jun 15, 2005 | 5.0 | 16 | NO | NO |
CVE-2006-2476MEDIUM Bitrix Site Manager 4.1.x stores updater.log under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information. | May 19, 2006 | 5.0 | 15 | NO | NO |
CVE-2006-2477MEDIUM Cross-site scripting (XSS) vulnerability in the administrative interface Bitrix Site Manager 4.1.x allows remote attackers to inject arbitrary web script or HTML via unspecified in | May 19, 2006 | 4.9 | 15 | NO | NO |
CVE-2006-2478MEDIUM Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified back_url during a HTTP POST request. NOTE: this issue has been referred to as " | May 19, 2006 | 5.0 | 15 | NO | NO |
CVE-2006-2479MEDIUM The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ulti | May 19, 2006 | 5.0 | 15 | NO | NO |
CVE-2005-1996MEDIUM PHP remote file inclusion vulnerability in start.php in Bitrix Site Manager 4.0.x allows remote attackers to execute arbitrary PHP code via the _SERVER[DOCUMENT_ROOT] parameter. | Jun 15, 2005 | 5.0 | 15 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Bitrix Site Manager
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.1.0 | 3 | 5.0 | 1.6% | 0 | 0 |
| 4.0.8 | 6 | 5.0 | 1.6% | 0 | 0 |
| 4.0.7 | 6 | 5.0 | 1.6% | 0 | 0 |
| 4.0.6 | 6 | 5.0 | 1.6% | 0 | 0 |
| 4.0.5 | 6 | 5.0 | 1.6% | 0 | 0 |
| 4.0.4 | 6 | 5.0 | 1.6% | 0 | 0 |
| 4.0.3 | 6 | 5.0 | 1.6% | 0 | 0 |
| 4.0.2 | 6 | 5.0 | 1.6% | 0 | 0 |
| 4.0.0 | 6 | 5.0 | 1.6% | 0 | 0 |