CVE-2022-27228

In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

20.78% chance of exploitation in the next 30 days, 97th percentile

Nuclei

critical · CWE-20

Published

2022-03-22

Updated

2024-08-03

Proof-of-concept exploits (1)

• JackPot777/bitrix9★ · 2022-08-30

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27228.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-27226
• CVE-2022-2723
• CVE-2022-27185
• CVE-2022-2724
• CVE-2022-27178
• CVE-2022-27249