Vulnerability in Bitrix24 Bitrix Framework
CVE-2020-28206
An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows brute-force attacks on the passwords of users not in the administrator group.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.011 (65.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 65th percentile — 65.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
- Bitrix24 Bitrix Framework — versions 20.0
Weakness classification (CWE)
References
- justrealstag.medium.com/user-enumeration-improper-restriction-of-excessive-auth… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-28206?
- CVE-2020-28206 is a medium-severity vulnerability in Bitrix24 Bitrix Framework, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 6.5/10. Published 2020-12-02.
- How severe is CVE-2020-28206?
- Medium severity. CVSS v3 base score is 6.5 out of 10.