CVE-2023-1717 — Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution

CVE-2023-1717

Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution PUBLISHED

Description (CNA)

Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.

Affected (CNA)

Vendor / product	Versions
Bitrix24 / Bitrix24	affected 0 through 22.0.300

CWE

CWE-79, CWE-1321

References

https://starlabs.sg/advisories/23/23-1717/

ADP enrichment

CVE

No English description supplied.

https://starlabs.sg/advisories/23/23-1717/

CISA-ADP

No English description supplied.

No references supplied.