Approved changes feed: RSS · Atom
cpe:2.3:a:bitrix24:bitrix24:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Bitrix24 (2e657019-eaab-5c9e-803c-020039daaa46) |
|---|---|
| Product | Bitrix24 (daa1f695-918f-52bd-914d-0495b973cd3d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-1720 |
vulnerable | 2026-06-08 05:52:36.843610 |
Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload
CRITICAL (9.6)
Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via uploading a crafted HTML file through /desktop_app/file.ajax.php?action=uploadfile.
Published: 2023-11-01T09:04:46.293Z
Updated: 2024-09-05T19:41:48.166Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1719 |
vulnerable | 2026-06-08 05:52:36.843125 |
Bitrix24 Insecure Global Variable Extraction
HIGH (7.5)
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.
Published: 2023-11-01T09:04:19.695Z
Updated: 2024-09-05T19:43:24.735Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1718 |
vulnerable | 2026-06-08 05:52:36.842648 |
Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access
HIGH (7.5)
Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "tmp_url".
Published: 2023-11-01T09:04:03.276Z
Updated: 2024-09-05T19:44:21.617Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1717 |
vulnerable | 2026-06-08 05:52:36.842170 |
Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution
CRITICAL (9.6)
Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.
Published: 2023-11-01T09:03:46.376Z
Updated: 2024-09-05T19:45:36.920Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1716 |
vulnerable | 2026-06-08 05:52:36.841647 |
Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)
CRITICAL (9)
Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege.
Published: 2023-11-01T09:03:24.512Z
Updated: 2024-09-05T19:52:50.595Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1715 |
vulnerable | 2026-06-08 05:52:36.841254 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1714 |
vulnerable | 2026-06-08 05:52:36.840720 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1713 |
vulnerable | 2026-06-08 05:52:36.839651 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-43959 |
vulnerable | 2026-06-08 05:49:35.072779 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-27228 |
vulnerable | 2026-06-08 05:41:55.037109 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13484 |
vulnerable | 2026-06-08 05:18:00.694674 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13483 |
vulnerable | 2026-06-08 05:18:00.694273 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.