Description
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Bitrix24 | Bitrix24 | ≤ 22.0.300 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Bitrix Component - Cross-Site Scripting http/cves/2023/CVE-2023-1719.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://starlabs.sg/advisories/23/23-1719/ third-party-advisory