PT-2024-7263 · 1с · Bitrix24+1

Oleg Labyntsev + 1 · Published 2024-04-23 · Updated 2024-11-06 · CVE-2024-34882

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 1C-Bitrix Bitrix24 version 23.300.100

Description The issue concerns insufficiently protected credentials in SMTP server settings, allowing remote administrators to send SMTP account passwords to an arbitrary server via an HTTP POST request. This could enable a remote attacker to gain access to authentication data from the SMTP server.

Recommendations For version 23.300.100, update to the latest patch version immediately and rotate compromised credentials. As a temporary workaround, consider restricting access to the SMTP server settings to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2024-08612

CVE-2024-34882

Affected Products

Bitrix24

Bitrix

References · 9

• https://bdu.fstec.ru/vul/2024-08612 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-34882 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34882 · Vendor Advisory
• https://github.com/DrieVlad/BitrixVulns · Note
• https://twitter.com/oktsec/status/1853537259603071149 · Twitter Post
• https://twitter.com/CVEnew/status/1853502855057228011 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1853589601992032639 · Twitter Post
• http://bitrix24.com · Note
• https://t.me/cvedetector/9777 · Telegram Post