CVE-2024-34883 — Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request

Back Back to CVE browser

MEDIUM

Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request

Published Nov 4, 2024

6.8

MEDIUM

CVSS 3.1

EPSS 0.38%

Description

Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request.

Affected products

Vendor Bitrix Product Bitrix24 Default
n/a
- Version
  20.300.100
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bitrix

Bitrix24

n/a

Version	Status	Constraints
20.300.100	affected	-

Remediation

No remediation recorded yet.

Metrics

0.38% 0.00376

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00376

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.38% (0.00376)	29.20th	v5 (v2026.06.15)
Jun 15, 2026	0.37% (0.00374)	29.00th	v5 (v2026.06.15)
Mar 17, 2025	0.06% (0.00058)	15.48th	v4 (v2025.03.14)
Dec 12, 2024	0.05% (0.00049)	20.06th	v3 (v2023.03.01)
Nov 5, 2024	0.04% (0.00043)	9.97th	v3 (v2023.03.01)