CVE-2023-1719 — Bitrix24 Insecure Global Variable Extraction

CVE-2023-1719

Bitrix24 Insecure Global Variable Extraction PUBLISHED

Description (CNA)

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.

Affected (CNA)

Vendor / product	Versions
Bitrix24 / Bitrix24	affected 0 through 22.0.300

CWE

CWE-665

References

https://starlabs.sg/advisories/23/23-1719/

ADP enrichment

CVE

No English description supplied.

https://starlabs.sg/advisories/23/23-1719/

CISA-ADP

No English description supplied.

No references supplied.