Back to Database
Status published
High
CVE-2023-1714
Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction
Vulnerability Description
Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitrary code via (1) appending arbitrary content to existing PHP files or (2) PHAR deserialization.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-1714
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Lam Jun Rong & Li Jiantao of STAR Labs SG Pte. Ltd. (@starlabs_sg)
References
More from Bitrix24
View All →CVE-2023-1720
Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload
Critical
9.6
CVE-2023-1719
Bitrix24 Insecure Global Variable Extraction
High
7.5
CVE-2023-1718
Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access
High
7.5
CVE-2023-1717
Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution
Critical
9.6
CVE-2023-1716
Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)
Critical
9
Affected Vendor
Bitrix24
View all reports →Affected Software
Bitrix24
Vulnerable Versions:
0
Timeline
Official Publish:
November 1st, 2023
Last Modified:
September 5th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H