CVE-2023-1717 — Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution
Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript cod…
Published: 2023-11-01 · CVSS: 9.6 · CVSS 3.1
Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7