CVE-2023-1718

Name of the Vulnerable Software and Affected Versions Bitrix24 version 22.0.300

Description An improper file stream access issue exists in the /desktop app/file.ajax.php?action=uploadfile component of Bitrix24. This allows unauthenticated remote attackers to cause a denial-of-service condition by using a crafted tmp url. The issue is related to a loop with an inaccessible exit condition. The affected API endpoint is /desktop app/file.ajax.php with the action parameter set to uploadfile. The vulnerable parameter is tmp url.

Recommendations Bitrix24 version 22.0.300: At the moment, there is no information about a newer version that contains a fix for this vulnerability.