VYPR
← All advisories
Critical severity9.6NVD Advisory· Published Nov 1, 2023· Updated Jun 17, 2026

CVE-2023-1717

CVE-2023-1717

Description

Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting __proto__[tag] and __proto__[text].

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Bitrix/Bitrix24llm-fuzzy2 versions
    = 22.0.300+ 1 more
    • (no CPE)range: = 22.0.300
    • (no CPE)range: 0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.