PatchTheCVEbitrix vulnerabilities and fixes
Recent CVEs affecting bitrix, with upgrade or downgrade steps. 2 tracked.
bitrix has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2017-08-24. Highest priority: CVE-2015-8356 (score 55/100).
- CVE-2015-8356 HIGH 8.0 UPGRADE Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authe
- CVE-2015-8355 HIGH 8.8 UPGRADE Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remot
FAQ
How do I fix bitrix vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is bitrix being exploited right now?
None of the tracked bitrix CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which bitrix CVE should I patch first?
CVE-2015-8356 currently ranks highest (55/100): Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authe.