CVE-2023-1715criticalCWE-79

CVE-2023-1715: critical vulnerability in Bitrix24

Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)

Published · Updated

Follow this CVE+ Monitor Bitrix24

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9epss 0.7%
A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
Bitrix24 · Bitrix24
Related CVEs — Bitrix24

In the same product, most dangerous first.

CVE-2023-1718HIGHBitrix24 Denial-of-Service (DoS) via Improper File Stream AccessEPSS 28.7%CVE-2023-1719HIGHBitrix24 Insecure Global Variable ExtractionEPSS 6.3%CVE-2023-1714HIGHBitrix24 Remote Command Execution (RCE) via Unsafe Variable ExtractionEPSS 1.8%CVE-2023-1713HIGHBitrix24 Remote Command Execution (RCE) via Insecure Temporary File CreationEPSS 1.6%CVE-2023-1717CRITICALBitrix24 Cross-Site Scripting (XSS) via Client-side Prototype PollutionEPSS 1.5%CVE-2023-1720CRITICALBitrix24 Stored Cross-Site Scripting (XSS) via File UploadEPSS 1.1%