CVE-2023-1719

HIGH NUCLEI

Bitrix24 22.0.300 - RCE

Title source: llm

Description

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.

Nuclei Templates (1)

Bitrix Component - Cross-Site Scripting

CRITICALVERIFIEDby DhiyaneshDk

Shodan: html:"/bitrix/" || http.html:"/bitrix/"

FOFA: body="/bitrix/"

References (1)

[Exploit, Third Party Advisory] https://starlabs.sg/advisories/23/23-1719/

Scores

CVSS v3 7.5

EPSS 0.8613

EPSS Percentile 99.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-665

Status published

Products (1)

bitrix24/bitrix24 22.0.300

Published Nov 01, 2023

Tracked Since Feb 18, 2026