CVE-2024-34885
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can read SMTP account passwords via an HTTP GET request.
Risk Assessment
The risk involves potential disclosure of SMTP passwords, which could lead to unauthorized access to the email server and possible takeover of the organization's email accounts.
Recommendation
It is recommended to immediately update 1C-Bitrix Bitrix24 to the latest version that fixes this vulnerability. Additionally, restrict administrative panel access to trusted administrators only.
Original NVD description (English source)
Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via HTTP GET request.