PT-2023-2848 · 1с · 1С-Битрикс

Publicado 2023-05-18 · Atualizado 2023-05-18

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 1С-Битрикс: Управление сайтом (affected versions not specified)

Description The issue is related to errors in processing input data in the built-in code editor of the 1С-Битрикс: Управление сайтом content management system. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-02793

Produtos afetados

1С-Битрикс

Referências · 4

• https://github.com/cr1f/writeups/blob/main/attacking_bitrix.pdf · Nota
• https://101primer.ru/t/86 · Nota
• https://bdu.fstec.ru/vul/2023-02793 · Nota de Segurança
• https://ydmitry.ru/blog/massovyy-vzlom-saytov-na-1s-bitriks-kak-zashchititsya · Nota