Lucene search

STAR_LabsCVE-2023-1718

HistoryNov 01, 2023 - 10:15 a.m.

CVE-2023-1718

2023-11-0110:15:09

CWE-835

STAR_Labs

web.nvd.nist.gov

cve-2023-1718

bitrix24

file stream access

denial-of-service

security vulnerability

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

42.9%

JSON

Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted “tmp_url”.

Affected configurations

Nvd

Node

bitrix24bitrix24Match22.0.300

VendorProductVersionCPE
bitrix24bitrix2422.0.300cpe:2.3:a:bitrix24:bitrix24:22.0.300:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bitrix24	bitrix24	22.0.300	cpe:2.3:a:bitrix24:bitrix24:22.0.300:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Bitrix24",
    "programFiles": [
      "file:desktop_app/file.ajax.php"
    ],
    "vendor": "Bitrix24",
    "versions": [
      {
        "lessThanOrEqual": "22.0.300",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

starlabs.sg/advisories/23/23-1718/

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

42.9%

JSON

Related for CVE-2023-1718