PT-2023-2848 · 1с · 1С-Битрикс

Published 2023-05-18 · Updated 2023-05-18

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 1С-Битрикс: Управление сайтом (affected versions not specified)

Description The issue is related to errors in processing input data in the built-in code editor of the 1С-Битрикс: Управление сайтом content management system. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-02793

Affected Products

1С-Битрикс

References · 4

• https://bdu.fstec.ru/vul/2023-02793 · Security Note
• https://github.com/cr1f/writeups/blob/main/attacking_bitrix.pdf · Note
• https://101primer.ru/t/86 · Note
• https://ydmitry.ru/blog/massovyy-vzlom-saytov-na-1s-bitriks-kak-zashchititsya · Note