CVE-2023-1715

🗓️ 01 Nov 2023 09:03:05Reported by STAR_LabsType

Logic error in mb_strpos() allows XSS bypass in Bitrix24 22.0.30

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2023-1715	4 Nov 202317:44	–	circl
CNNVD	Bitrix24 Cross-Site Scripting Vulnerability	1 Nov 202300:00	–	cnnvd
Cvelist	CVE-2023-1715 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)	1 Nov 202309:03	–	cvelist
EUVD	EUVD-2023-23938	3 Oct 202520:07	–	euvd
NVD	CVE-2023-1715	1 Nov 202310:15	–	nvd
OSV	CVE-2023-1715	1 Nov 202310:15	–	osv
Prion	Cross site scripting	1 Nov 202310:15	–	prion
Positive Technologies	PT-2023-6693 · Bitrix +1 · Bitrix24 +1	1 Nov 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-1715	23 May 202505:04	–	redhatcve
Vulnrichment	CVE-2023-1715 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)	1 Nov 202309:03	–	vulnrichment

NVD

Node

bitrix24 bitrix24Match22.0.300

[
  {
    "defaultStatus": "unaffected",
    "product": "Bitrix24",
    "programFiles": [
      "file:bitrix/components/bitrix/crm.invoice.edit/component.php"
    ],
    "vendor": "Bitrix24",
    "versions": [
      {
        "lessThanOrEqual": "22.0.300",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
starlabs	www.starlabs.sg/advisories/23/23-1715/

21 Nov 2024 07:39Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.4 - 9

EPSS0.00067

SSVC

CWE-79