CVE-2023-1717

CRITICAL

Bitrix24 22.0.300 - Prototype Pollution leading to Cross-Site Scripting and Potential Remote Code Execution

Title source: llm

Description

Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.

References (1)

Core 1

Core References

Exploit, Third Party Advisory third-party-advisory

https://starlabs.sg/advisories/23/23-1717/

Scores

CVSS v3 9.6

EPSS 0.0105

EPSS Percentile 59.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-79 CWE-1321

Status published

Products (1)

bitrix24/bitrix24 22.0.300

Published Nov 01, 2023

Tracked Since Feb 18, 2026