CVE-2023-1713CWE-434

Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation

High · published November 1, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
68.7
In the wild
Unconfirmed
What it is

Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticated attackers to execute arbitrary code via uploading a crafted ".htaccess" file.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01231 · 68.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2023-11-01T09:02Z
EPSS history
Timeline
  • 01 NOV 09:02Z
    Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation
    cvelistv5