Skip to content
Noroxi

Bitrix24 records

20 published records for vendor bitrix24.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20
  2. 22
  3. 23
  4. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

20 records
  • CVE-2022-27228
    45Plan

    In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    bitrix24 · bitrix24Mar 22, 2022

  • CVE-2023-1719
    40Plan

    Bitrix24 Insecure Global Variable Extraction

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2020-13484
    40Plan

    Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the

    CriticalCVSS 9.8No exploitEPSS 2%

    bitrix24 · bitrix24Jun 24, 2020

  • CVE-2023-1717
    38Monitor

    Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution

    CriticalCVSS 9.6No exploitEPSS 1%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2023-1716
    38Monitor

    Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)

    CriticalCVSS 9.6No exploitEPSS 1%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2023-1718
    37Monitor

    Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access

    HighCVSS 7.5Proof of conceptEPSS 24%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2023-1714
    35Monitor

    Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction

    HighCVSS 8.8No exploitEPSS 1%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2023-1713
    35Monitor

    Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation

    HighCVSS 8.8No exploitEPSS 1%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2023-1720
    32Monitor

    Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload

    HighCVSS 8.0No exploitEPSS 1%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2024-34885
    27Monitor

    Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP acco

    MediumCVSS 6.8No exploitEPSS 0%

    bitrix24 · bitrix24Nov 4, 2024

  • CVE-2024-34891
    27Monitor

    Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange a

    MediumCVSS 6.8No exploitEPSS 0%

    bitrix24 · bitrix24Nov 4, 2024

  • CVE-2020-28206
    26Monitor

    An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0.

    MediumCVSS 6.5No exploitEPSS 1%

    bitrix24 · bitrix frameworkDec 2, 2020

  • CVE-2020-13483
    25Monitor

    The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.lis

    MediumCVSS 6.1Proof of conceptEPSS 5%

    bitrix24 · bitrix24Jun 24, 2020

  • CVE-2008-2052
    24Monitor

    Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and

    MediumCVSS 6.1Proof of conceptEPSS 2%

    bitrix24 · bitrix site managerMay 2, 2008

  • CVE-2023-1715
    21Monitor

    Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)

    MediumCVSS 5.4No exploitEPSS 1%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2017-20122
    21Monitor

    Bitrix Site Manager Contact Form cross site scripting

    MediumCVSS 5.4No exploitEPSS 1%

    bitrix24 · bitrix site managerJun 30, 2022

  • CVE-2022-43959
    19Monitor

    Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to

    MediumCVSS 4.9Proof of conceptEPSS 1%

    bitrix24 · bitrix24Jan 20, 2023

  • CVE-2024-34883
    19Monitor

    Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-serve

    MediumCVSS 4.9No exploitEPSS 0%

    bitrix24 · bitrix24Nov 4, 2024

  • CVE-2024-34882
    19Monitor

    Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP acco

    MediumCVSS 4.9No exploitEPSS 0%

    bitrix24 · bitrix24Nov 4, 2024

  • CVE-2024-34887
    19Monitor

    Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDA

    MediumCVSS 4.9No exploitEPSS 0%

    bitrix24 · bitrix24Nov 4, 2024