CVE-2023-1714 — Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction

CVE-2023-1714

Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction PUBLISHED

Description (CNA)

Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitrary code via (1) appending arbitrary content to existing PHP files or (2) PHAR deserialization.

Affected (CNA)

Vendor / product	Versions
Bitrix24 / Bitrix24	affected 0 through 22.0.300

CWE

CWE-502

References

https://starlabs.sg/advisories/23/23-1714/

ADP enrichment

CVE

No English description supplied.

https://starlabs.sg/advisories/23/23-1714/

CISA-ADP

No English description supplied.

No references supplied.