CVE-2023-1713

🗓️ 01 Nov 2023 09:02:18Reported by STAR_LabsType

cve🔗 web.nvd.nist.gov👁 137 Views🌐 WEB

Insecure temp file creation in Bitrix24 22.0.300 allows remote code execution

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2023-1713	1 Nov 202313:21	–	circl
CNNVD	Bitrix24 Security Vulnerability	1 Nov 202300:00	–	cnnvd
Cvelist	CVE-2023-1713 Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation	1 Nov 202309:02	–	cvelist
EUVD	EUVD-2023-23936	3 Oct 202520:07	–	euvd
NVD	CVE-2023-1713	1 Nov 202310:15	–	nvd
Prion	Code injection	1 Nov 202310:15	–	prion
Positive Technologies	PT-2023-6694	1 Nov 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-1713	23 May 202502:34	–	redhatcve
Vulnrichment	CVE-2023-1713 Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation	1 Nov 202309:02	–	vulnrichment

NVD

Node

bitrix24 bitrix24Match22.0.300

[
  {
    "defaultStatus": "unaffected",
    "product": "Bitrix24",
    "programFiles": [
      "file:bitrix/components/bitrix/crm.order.import.instagram.view/class.php"
    ],
    "vendor": "Bitrix24",
    "versions": [
      {
        "lessThanOrEqual": "22.0.300",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
starlabs	www.starlabs.sg/advisories/23/23-1713/

Parameter	Position	Path	Description	CWE
file	request body	bitrix/modules/crm/lib/order/import/instagram.php	Insecure temporary file creation allows uploading a crafted .htaccess leading to remote code execution	CWE-434
filename	request body	bitrix/modules/crm/lib/order/import/instagram.php	Insecure temporary file creation allows uploading a crafted .htaccess leading to remote code execution	CWE-434
content	request body	bitrix/modules/crm/lib/order/import/instagram.php	Insecure temporary file creation allows uploading a crafted .htaccess leading to remote code execution	CWE-434

21 Nov 2024 07:39Current

8.7High risk

Vulners AI Score8.7

CVSS 3.18.8

EPSS0.03851

SSVC

CWE-434