CVE-2024-34887
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request.
Risk Assessment
The risk involves potential interception of AD/LDAP administrator passwords by an attacker, which could lead to unauthorized access to the entire directory infrastructure of the organization.
Recommendation
Immediately update 1C-Bitrix Bitrix24 to the latest version that fixes this vulnerability. Additionally, restrict access to AD/LDAP settings to trusted administrators only.
Original NVD description (English source)
Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request.