CVE-2023-1715 — Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)

CVE-2023-1715

Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2) PUBLISHED

Description (CNA)

A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload.

Affected (CNA)

Vendor / product	Versions
Bitrix24 / Bitrix24	affected 0 through 22.0.300

CWE

CWE-79

References

https://starlabs.sg/advisories/23/23-1715/

ADP enrichment

CVE

No English description supplied.

https://starlabs.sg/advisories/23/23-1715/

CISA-ADP

No English description supplied.

No references supplied.