CVE-2023-1718

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "tmp_url".

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
Bitrix24	Bitrix24	<= 22.0.300

References

https://starlabs.sg/advisories/23/23-1718/Exploit, Third Party Advisory
https://starlabs.sg/advisories/23/23-1718/Exploit, Third Party Advisory

Timeline

Published: Nov 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-17199.8Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate at CVE-2023-17208.0Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the vic CVE-2023-17217.2Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the applicati CVE-2023-17228.8Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the applicati CVE-2023-17239.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veragroup Mobile Assistant allows SQL CVE-2023-17245.4Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. This o CVE-2023-17259.8Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affec CVE-2023-17265.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proliz OBS allows Stored XSS for an au CVE-2023-17289.8Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SS CVE-2023-17296.5A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.CVE-2023-17309.8The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allo CVE-2023-17317.2In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would al