PT-2020-13566
CVE-2020-13483
·
تاريخ النشر
2020-06-24
·
تاريخ التحديث
2025-07-23
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Bitrix24 versions prior to 20.0.0
Description
The issue concerns a security problem where an attacker can execute malicious scripts on a user's browser, potentially leading to unauthorized actions. This is achieved by exploiting the
items[ITEMS][ID] parameter in the "components/bitrix/mobileapp.list/ajax.php/" API endpoint.Recommendations
For versions prior to 20.0.0, consider restricting access to the "components/bitrix/mobileapp.list/ajax.php/" API endpoint until a patch is available. As a temporary workaround, avoid using the
items[ITEMS][ID] parameter in the affected endpoint to minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾