CVE-2023-1718

🗓️ 01 Nov 2023 09:04:03Reported by STAR_LabsType

cve🔗 web.nvd.nist.gov👁 82 Views🌐 WEB

Improper file stream access in Bitrix24 22.0.300 allows denial-of-servic

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of the `desktop_app/file.ajax.php?action=uploadfile` component in the main module of the Bitrix24 business management service allows a attacker to cause a service failure.	3 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-1718	1 Nov 202313:21	–	circl
CNNVD	Bitrix24 Security Vulnerability	1 Nov 202300:00	–	cnnvd
Cvelist	CVE-2023-1718 Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access	1 Nov 202309:04	–	cvelist
NVD	CVE-2023-1718	1 Nov 202310:15	–	nvd
OSV	CVE-2023-1718	1 Nov 202310:15	–	osv
Prion	Input validation	1 Nov 202310:15	–	prion
Positive Technologies	PT-2023-6690	1 Nov 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-1718	23 May 202503:00	–	redhatcve
Vulnrichment	CVE-2023-1718 Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access	1 Nov 202309:04	–	vulnrichment

NVD

Node

bitrix24 bitrix24Match22.0.300

[
  {
    "defaultStatus": "unaffected",
    "product": "Bitrix24",
    "programFiles": [
      "file:desktop_app/file.ajax.php"
    ],
    "vendor": "Bitrix24",
    "versions": [
      {
        "lessThanOrEqual": "22.0.300",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
starlabs	www.starlabs.sg/advisories/23/23-1718/

Parameter	Position	Path	Description	CWE
tmp_url	request body	/desktop_app/file.ajax.php?action=uploadfile	Improper file stream access in the upload endpoint can be exploited via a crafted tmp_url to cause denial-of-service	CWE-835

17 Jun 2026 05:28Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.24078

SSVC

CWE-835