CVE-2024-34883
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read proxy-server account passwords via an HTTP GET request.
Risk Assessment
The risk involves potential disclosure of proxy-server account passwords, which could lead to unauthorized access to network resources and further attacks.
Recommendation
It is recommended to immediately update 1C-Bitrix Bitrix24 to the latest version and restrict access to DAV server settings to trusted administrators only.
Original NVD description (English source)
Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request.