CVE-2023-1717

Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution

State: Published
Severity: 9.6 Critical
Published: Nov 1, 2023
Updated: Sep 5, 2024
Reserved: Mar 30, 2023

Description

Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.

Scores

CVSS	Score	Vector	Source
3.1	9.6 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	STAR_Labs

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1321 Prototype Pollution

Affected Products

Product	Versions
Bitrix24Bitrix24	22.0.300 and earlierAffected

References

https://starlabs.sg/advisories/23/23-1717/third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.