Bitrix24 22.0.300

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:bitrix24:bitrix24:22.0.300:*:*:*:*:*:*:*

part: a version: 22.0.300 update: *

VendorBitrix24 (2e657019-eaab-5c9e-803c-020039daaa46)
ProductBitrix24 (daa1f695-918f-52bd-914d-0495b973cd3d)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-1720 vulnerable 2026-06-08 05:52:36.843639 Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload
CRITICAL (9.6)
Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via uploading a crafted HTML file through /desktop_app/file.ajax.php?action=uploadfile.
Published: 2023-11-01T09:04:46.293Z
Updated: 2024-09-05T19:41:48.166Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-1719 vulnerable 2026-06-08 05:52:36.843248 Bitrix24 Insecure Global Variable Extraction
HIGH (7.5)
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.
Published: 2023-11-01T09:04:19.695Z
Updated: 2024-09-05T19:43:24.735Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-1718 vulnerable 2026-06-08 05:52:36.842761 Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access
HIGH (7.5)
Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "tmp_url".
Published: 2023-11-01T09:04:03.276Z
Updated: 2024-09-05T19:44:21.617Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-1717 vulnerable 2026-06-08 05:52:36.842207 Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution
CRITICAL (9.6)
Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.
Published: 2023-11-01T09:03:46.376Z
Updated: 2024-09-05T19:45:36.920Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-1716 vulnerable 2026-06-08 05:52:36.841677 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)
CRITICAL (9)
Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege.
Published: 2023-11-01T09:03:24.512Z
Updated: 2024-09-05T19:52:50.595Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-1715 vulnerable 2026-06-08 05:52:36.841290 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-1714 vulnerable 2026-06-08 05:52:36.840761 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-1713 vulnerable 2026-06-08 05:52:36.840270 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.