Vulnerabilities > Bitrix24 > Bitrix24 > 20.0.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-01-20 | CVE-2022-43959 | Information Exposure vulnerability in Bitrix24 20.0.0/20.0.975 Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP administrative password by reading the source code of /bitrix/admin/ldap_server_edit.php. | 4.9 |
| 2022-03-22 | CVE-2022-27228 | Improper Input Validation vulnerability in Bitrix24 20.0.0/20.0.975 In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code. | 10.0 |
| 2020-06-24 | CVE-2020-13484 | Server-Side Request Forgery (SSRF) vulnerability in Bitrix24 20.0.0/20.0.975 Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the destination URL hosts an HTML document containing '<meta name="og:image" content="' followed by an intranet URL. | 7.5 |
| 2020-06-24 | CVE-2020-13483 | Cross-site Scripting vulnerability in Bitrix24 20.0.0 The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI. | 4.3 |