CVEvulnerability

CVE-2023-1717

9.6 CRITICAL Published 2023-11-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-11-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.6 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.6 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-1321, CWE-79

Description

Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.

Affected configurations

• bitrix24 bitrix24 22.0.300

Related

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References