CVE-2020-13483

Name of the Vulnerable Software and Affected Versions Bitrix24 versions prior to 20.0.0

Description The issue concerns a security problem where an attacker can execute malicious scripts on a user's browser, potentially leading to unauthorized actions. This is achieved by exploiting the items[ITEMS][ID] parameter in the "components/bitrix/mobileapp.list/ajax.php/" API endpoint.

Recommendations For versions prior to 20.0.0, consider restricting access to the "components/bitrix/mobileapp.list/ajax.php/" API endpoint until a patch is available. As a temporary workaround, avoid using the items[ITEMS][ID] parameter in the affected endpoint to minimize the risk of exploitation.