CVE-2023-1719 - CVE House
Back to Database
Status published High CVE-2023-1719

Bitrix24 Insecure Global Variable Extraction

Vulnerability Description

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-1719

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Lam Jun Rong & Li Jiantao of STAR Labs SG Pte. Ltd. (@starlabs_sg)

References

More from Bitrix24

View All →
CVE-2023-1720
Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload
Critical 9.6
CVE-2023-1718
Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access
High 7.5
CVE-2023-1717
Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution
Critical 9.6
CVE-2023-1716
Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)
Critical 9
CVE-2023-1715
Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)
Critical 9

Affected Vendor

Affected Software

Bitrix24
Vulnerable Versions:
0

Timeline

Official Publish: November 1st, 2023
Last Modified: September 5th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-665

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.