Skip to content
OpenAdvisories

Vendor

Bitrix24

8 known vulnerabilities.

Products

Bitrix24 8
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2023-1719

    Bitrix24 Insecure Global Variable Extraction

    Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitra…

    Bitrix24 Bitrix24
  • High 7.5
    CVE-2023-1718 Public exploit EPSS 29%

    Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access

    Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "tmp_url".

    Bitrix24 Bitrix24
  • High 8.8
    CVE-2023-1714

    Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction

    Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitrary code via (1) appending arbitrary content to existing PHP files or (2) PHAR deserialization.

    Bitrix24 Bitrix24
  • High 8.8
    CVE-2023-1713

    Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation

    Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticated attackers to execute arbitrary code via uploading a crafted ".htaccess" file.

    Bitrix24 Bitrix24