CVE-2020-13483

MEDIUMNuclei

bitrix24 bitrix24 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2020-13483 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 15, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

bitrix24

Browse bitrix24 / bitrix24
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMBitrix24 <=20.0.0 - Cross-Site ScriptingCVSS 6.1

The Web Application Firewall in Bitrix24 up to and including 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to a patched version of Bitrix24 (version >20.0.0) to mitigate this vulnerability.

WeaknessesCWE-79
Authorspikpikcu, 3th1c_yuk1, s4e-io
Template tagscve2020cvexssbitrixbitrix24vkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:bitrix24:bitrix24:*:*:*:*:*:*:*:*
Shodan: http.html:"/bitrix/"
FOFA: body="/bitrix/"
https://gist.github.com/mariuszpoplwski/ca6258cf00c723184ebd2228ba81f558 https://twitter.com/brutelogic/status/1483073170827628547 https://nvd.nist.gov/vuln/detail/CVE-2020-13483 https://github.com/afinepl/research https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2