Back to Database
Status published
Critical
CVE-2023-1716
Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)
Vulnerability Description
Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-1716
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Lam Jun Rong & Li Jiantao of STAR Labs SG Pte. Ltd. (@starlabs_sg)
References
More from Bitrix24
View All →CVE-2023-1720
Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload
Critical
9.6
CVE-2023-1719
Bitrix24 Insecure Global Variable Extraction
High
7.5
CVE-2023-1718
Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access
High
7.5
CVE-2023-1717
Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution
Critical
9.6
CVE-2023-1715
Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)
Critical
9
Affected Vendor
Bitrix24
View all reports →Affected Software
Bitrix24
Vulnerable Versions:
0
Timeline
Official Publish:
November 1st, 2023
Last Modified:
September 5th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H