CVE-2023-1718CWE-835

Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access

High · published November 1, 2023

CVSS v3.1

7.5

EPSS

24%

Percentile

97.8

In the wild

Unconfirmed

What it is

Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "tmp_url".

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.24078 · 97.8th percentile
Weakness: CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published: 2023-11-01T09:04Z

EPSS history

Timeline

01 NOV 09:04Z
Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access
cvelistv5