CVE-2024-34883 Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request.

MediumCVSS 4.9 EPSS 0.38%

Published: 2024-11-04 02:44 (approximate time: when CVE Radar first recorded it)
Updated: 2026-07-05 04:19
Exploit status: No public exploit known

Description

Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request.

Affected products

Product	Affected versions	Fixed in
bitrix24	= 20.300.100	No fix listed
Bitrix24	= 23.300.100	No fix listed

References

github.com third-party-advisory

CVSS v3.1

4.9 Medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

All scores (2)

v3.1 4.9 · nvd@nist.gov
v3.1 6.8 · cisa-adp

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.38% (percentile 32.0)
CWE: CWE-522 Insufficiently Protected Credentials

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.