CVE-2022-43959: BITRIX24

Medium severity, CVSS 4.9. EPSS: 1% chance of exploitation in the next 30 days.

Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP administrative password by reading the source code of /bitrix/admin/ldap_server_edit.php.

Affected products

• BITRIX24 BITRIX24: up to and including 22.200.200

Published 2023-01-20. Last modified 2026-06-17.