CVE-2023-1720

Summary

CVE-2023-1720 is a vulnerability affecting Bitrix24 version 22.0.300. The issue lies in the lack of a mime type response header, which enables authenticated attackers to inject arbitrary JavaScript code in victims' browsers. With sufficient privileges, attackers may also be able to execute PHP code on the server by uploading a specially crafted HTML file via the /desktop_app/file.ajax.php?action=uploadfile endpoint.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.