CVE-2024-34891: BITRIX24

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange account passwords via HTTP GET request.

Affected products

• BITRIX24 BITRIX24: version 23.300.100 only

Published 2024-11-04. Last modified 2026-07-05.