CVE-2022-27228 Code injection in n/a
Remote unauthenticated attackers can execute arbitrary code in the Bitrix Site Manager vote module, requiring an upgrade to secure the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27228?
CVE-2022-27228 is a critical code injection vulnerability in n/a, published on 22 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.
Weakness: CWE-20
Which versions are affected by CVE-2022-27228?
It affects 1 product.
Products include Bitrix24 Bitrix24.
How do I fix CVE-2022-27228?
No fix has been published for CVE-2022-27228 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-27228 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-27228 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2020-13484 Server-side request forgery in n/a
- CVE-2023-1717 Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution
- CVE-2023-1720 Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload
- CVE-2023-1715 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)
- CVE-2023-1716 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)
Sources
Also known as GHSA-c23g-9x2x-4x3p.