PT-2020-16946 · Bitrix · Bitrix24 Bitrix Framework

Published 2020-12-02 · Updated 2020-12-04 · CVE-2020-28206

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bitrix24 Bitrix Framework (1c site management) version 20.0

Description An issue exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows brute-force attacks on the passwords of users not in the administrator group.

Recommendations For version 20.0, consider restricting access to the admin login form to minimize the risk of exploitation. As a temporary workaround, consider implementing additional authentication measures, such as rate limiting or IP blocking, to prevent brute-force attacks.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2020-28206

Affected Products

Bitrix24 Bitrix Framework

References · 5

• 🔥 https://justrealstag.medium.com/user-enumeration-improper-restriction-of-excessive-authentication-attempts-in-bitrix-98933a97e0e6 · Exploit
• https://osv.dev/vulnerability/CVE-2020-28206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28206 · Security Note
• https://t.me/cibsecurity/17057 · Telegram Post
• https://t.me/cvenotify/6495 · Telegram Post