← Database

CVE-2023-1714

HIGH CVSS: 8.8 Published: 2023-11-01 Modified: 2026-06-17

Description

Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitrary code via (1) appending arbitrary content to existing PHP files or (2) PHAR deserialization.

Affected Platforms

Bitrix24 Bitrix24

Weakness Type

CWE-502, CWE-502

References