CVE-2024-34887
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request.
Risk Assessment
The risk involves potential interception of AD/LDAP administrator passwords by an attacker, which could lead to unauthorized access to the entire directory infrastructure of the organization.
Recommendation
Immediately update 1C-Bitrix Bitrix24 to the latest version that fixes this vulnerability. Additionally, restrict access to AD/LDAP settings to trusted administrators only.
Other vulnerabilities in 1C-Bitrix Bitrix24
See all- CVE-2024-34891Medium
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read Exchange account passwords via an HTTP GET request.
- CVE-2024-34885Medium
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can read SMTP account passwords via an HTTP GET request.
- CVE-2024-34883Medium
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read proxy-server account passwords via an HTTP GET request.
- CVE-2024-34882Medium
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can send SMTP account passwords to an arbitrary server via an HTTP POST request.
Original NVD description (English source)
Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS