Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.
References
Link | Resource |
---|---|
https://starlabs.sg/advisories/23/23-1717/ | Exploit Third Party Advisory |
Configurations
History
09 Nov 2023, 20:50
Type | Values Removed | Values Added |
---|---|---|
First Time |
Bitrix24 bitrix24
Bitrix24 |
|
CPE | cpe:2.3:a:bitrix24:bitrix24:22.0.300:*:*:*:*:*:*:* | |
CWE | CWE-79 CWE-1321 |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.6 |
References | (MISC) https://starlabs.sg/advisories/23/23-1717/ - Exploit, Third Party Advisory |
01 Nov 2023, 10:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-11-01 10:15
Updated : 2023-12-10 15:14
NVD link : CVE-2023-1717
Mitre link : CVE-2023-1717
CVE.ORG link : CVE-2023-1717
JSON object : View
Products Affected
bitrix24
- bitrix24