CVE-2024-34882
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can send SMTP account passwords to an arbitrary server via an HTTP POST request.
Risk Assessment
The risk involves potential interception of SMTP passwords by unauthorized parties, which could lead to unauthorized access to mail servers and further attacks on the organization's infrastructure.
Recommendation
It is recommended to immediately update 1C-Bitrix Bitrix24 to the latest version and implement additional credential protection mechanisms, such as encryption at rest and in transit.
Other vulnerabilities in 1C-Bitrix Bitrix24
See all- CVE-2024-34891Medium
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read Exchange account passwords via an HTTP GET request.
- CVE-2024-34885Medium
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can read SMTP account passwords via an HTTP GET request.
- CVE-2024-34887Medium
Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request.
- CVE-2024-34883Medium
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read proxy-server account passwords via an HTTP GET request.
Original NVD description (English source)
Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to an arbitrary server via HTTP POST request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS