CVE-2024-34885: BITRIX24

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via HTTP GET request.

Affected products

• BITRIX24 BITRIX24: version 23.300.100 only

Published 2024-11-04. Last modified 2026-07-05.