CVE-2023-1717 Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution

Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/leftvertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege...

CVE-2023-1717

Bitrix24 22.0.300 is affected by a prototype pollution vulnerability in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js. Attackers can pollute proto [tag] and proto [text], enabling remote JavaScript execution in the victim’s browser and potentially arbitrary PHP code on ...