Vulnerability in Bitrix24 Bitrix Framework
CVE-2020-28206
An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows brute-force attacks on the passwords of users not in the administrator group.
EPSS: 0.011 (63.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Bitrix24 Bitrix_framework — versions 20.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-28206?
- CVE-2020-28206 is a medium-severity vulnerability in Bitrix24 Bitrix Framework, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 6.5/10. Published 2020-12-02.
- How severe is CVE-2020-28206?
- Medium severity. CVSS v3 base score is 6.5 out of 10.