CVE-2024-34882: BITRIX24

Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days.

Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to an arbitrary server via HTTP POST request.

Affected products

• BITRIX24 BITRIX24: version 23.300.100 only

Published 2024-11-04. Last modified 2026-07-05.