CVE-2023-1720

CVE-2023-1720 is a high-severity vulnerability in Bitrix24 version 22.0.300, stemming from a missing MIME type response header. This flaw allows an authenticated attacker to upload a crafted HTML file, leading to arbitrary JavaScript execution in a victim's browser and potentially arbitrary PHP code execution on the server if the victim has administrator privileges. With a CVSS score of 8.0, the attack requires user interaction and low privileges but can result in high impact to confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating awareness and potential future exploitation.