CVE-2023-1719highCWE-665

CVE-2023-1719: falha de alta gravidade em Bitrix24

Bitrix24 Insecure Global Variable Extraction

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Bitrix24

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 7.5epss 6.3%
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Bitrix24 · Bitrix24
CVEs relacionadas — Bitrix24

No mesmo produto, das mais perigosas para as menos.

CVE-2023-1718HIGHBitrix24 Denial-of-Service (DoS) via Improper File Stream AccessEPSS 28.7%CVE-2023-1714HIGHBitrix24 Remote Command Execution (RCE) via Unsafe Variable ExtractionEPSS 1.8%CVE-2023-1713HIGHBitrix24 Remote Command Execution (RCE) via Insecure Temporary File CreationEPSS 1.6%CVE-2023-1717CRITICALBitrix24 Cross-Site Scripting (XSS) via Client-side Prototype PollutionEPSS 1.5%CVE-2023-1720CRITICALBitrix24 Stored Cross-Site Scripting (XSS) via File UploadEPSS 1.1%CVE-2023-1716CRITICALBitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)EPSS 0.8%