Paper/Archive/CVE-2023-1716

CVE-2023-1716

Bitrix24 Bitrix24 — Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)

EPSS 0.7%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (NVD)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 53.7.537 × 2010.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege.

Affected

ProductAffectedFixed inSource

Bitrix24≤ 22.0.300–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

STAR_Labs (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupstarlabs.sg/advisories/23/23-1716