CVE-2023-1715: BITRIX24

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload.

Affected products

• BITRIX24 BITRIX24: version 22.0.300 only

Published 2023-11-01. Last modified 2026-06-17.