CVE-2023-1717 - CVE House
Back to Database
Status published Critical CVE-2023-1717

Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution

Vulnerability Description

Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-1717

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Lam Jun Rong & Li Jiantao of STAR Labs SG Pte. Ltd. (@starlabs_sg)

References

More from Bitrix24

View All →
CVE-2023-1720
Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload
Critical 9.6
CVE-2023-1719
Bitrix24 Insecure Global Variable Extraction
High 7.5
CVE-2023-1718
Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access
High 7.5
CVE-2023-1716
Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)
Critical 9
CVE-2023-1715
Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)
Critical 9

Affected Vendor

Affected Software

Bitrix24
Vulnerable Versions:
0

Timeline

Official Publish: November 1st, 2023
Last Modified: September 5th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-79 CWE-1321

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact