PT-2020-13566 · Bitrix+1 · Bitrix24+1
Mariusz Poplawski
·
Published
2020-06-24
·
Updated
2025-07-23
·
CVE-2020-13483
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Bitrix24 versions prior to 20.0.0
Description
The issue concerns a security problem where an attacker can execute malicious scripts on a user's browser, potentially leading to unauthorized actions. This is achieved by exploiting the
items[ITEMS][ID] parameter in the "components/bitrix/mobileapp.list/ajax.php/" API endpoint.Recommendations
For versions prior to 20.0.0, consider restricting access to the "components/bitrix/mobileapp.list/ajax.php/" API endpoint until a patch is available. As a temporary workaround, avoid using the
items[ITEMS][ID] parameter in the affected endpoint to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bitrix
Bitrix24