CVE-2005-1995 Bitrix Site Manager 4.0.x allows remote attackers to obtain sensitive information via direct request to (1) subscr_form.php or (2) dbquery_error.php, which reveals the path in an error message.
MediumCVSS 5.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Bitrix Site Manager 4.0.x allows remote attackers to obtain sensitive information via direct request to (1) subscr_form.php or (2) dbquery_error.php, which reveals the path in an error message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bitrix site manager | = 4.0.0 | No fix listed |
| bitrix site manager | = 4.0.2 | No fix listed |
| bitrix site manager | = 4.0.3 | No fix listed |
| bitrix site manager | = 4.0.4 | No fix listed |
| bitrix site manager | = 4.0.5 | No fix listed |
| bitrix site manager | = 4.0.6 | No fix listed |
| bitrix site manager | = 4.0.7 | No fix listed |
| bitrix site manager | = 4.0.8 | No fix listed |
References
- 20050615 Vulnerability: Bitrix Web Server Paths mailing-list
- 17348 patch vdb-entry
- 17376 patch vdb-entry
- bitrix-site-path-disclosure(21019) vdb-entry