CVE-2020-13484: BITRIX24

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the destination URL hosts an HTML document containing '<meta name="og:image" content="' followed by an intranet URL.

Affected products

• BITRIX24 BITRIX24: up to and including 20.0.975

Published 2020-06-24. Last modified 2026-06-17.