CVE-2024-34883
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read proxy-server account passwords via an HTTP GET request.
Risk Assessment
The risk involves potential disclosure of proxy-server account passwords, which could lead to unauthorized access to network resources and further attacks.
Recommendation
It is recommended to immediately update 1C-Bitrix Bitrix24 to the latest version and restrict access to DAV server settings to trusted administrators only.
Other vulnerabilities in 1C-Bitrix Bitrix24
See all- CVE-2024-34891Medium
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read Exchange account passwords via an HTTP GET request.
- CVE-2024-34885Medium
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can read SMTP account passwords via an HTTP GET request.
- CVE-2024-34887Medium
Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request.
- CVE-2024-34882Medium
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can send SMTP account passwords to an arbitrary server via an HTTP POST request.
Original NVD description (English source)
Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS