CVE-2023-1715: Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)
Published Nov 1, 2023
·Updated
A logic error when using mbstrpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload.
Affected Software
1 affected component
Bitrix24 Bitrix24=22.0.300
Event History
Nov 1, 2023
CVE Published
09:03 AM
Data Sourced
09:03 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-1715?
CVE-2023-1715 is a vulnerability that allows attackers to bypass XSS sanitization in Bitrix24 22.0.300 by placing HTML tags at the beginning of the payload.
2
How severe is CVE-2023-1715?
CVE-2023-1715 has a severity level of critical.
3
How does CVE-2023-1715 affect Bitrix24?
CVE-2023-1715 affects Bitrix24 version 22.0.300.
4
How can I fix CVE-2023-1715 in Bitrix24?
To fix CVE-2023-1715, it is recommended to update Bitrix24 to a version that includes the security patch for this vulnerability.
5
Where can I find more information about CVE-2023-1715?
More information about CVE-2023-1715 can be found at [https://starlabs.sg/advisories/23/23-1715/](https://starlabs.sg/advisories/23/23-1715/).