This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2023-1717 | BDVDB-2026-215709 Detail

Bitrix24Bitrix24

Description#

Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.

Impact#

CAPEC-588 DOM-Based XSS

Weaknesses#

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.