Security readout for executives and security teams
Plain-English summary
A Bitrix24 issue can let a remote administrator redirect stored SMTP account passwords to a server they control. This is not a broad unauthenticated compromise, but it can expose mail credentials and enable follow-on abuse if an administrator account is misused or compromised.
Executive priority
Treat this as a moderate credential exposure issue. It is most urgent where Bitrix24 administrators are numerous, remote admin access is exposed, or SMTP credentials grant access to sensitive mail systems. Prioritize verification, access control review, and vendor update tracking.
Technical view
CVE-2024-34882 is a CWE-522 credential protection flaw in 1C-Bitrix Bitrix24 23.300.100 SMTP server settings. The CVSS 3.1 score is 6.8, with network access, low complexity, high privileges, no user interaction, changed scope, and high confidentiality impact.
Likely exposure
Exposure appears limited to Bitrix24 23.300.100 environments where remote administrators can access SMTP server settings. The provided CVE data does not list CPEs or broader affected version ranges, so teams should confirm applicability with vendor guidance.
Exploitation context
The source bundle does not show CISA KEV listing or other evidence of active exploitation. The described attack requires high privileges and allows SMTP account passwords to be sent to an arbitrary server by HTTP POST, creating credential theft risk after admin compromise or insider misuse.
Researcher notes
Public data is sparse. The CVE record names Bitrix24 23.300.100 and CWE-522, but affected vendor/product fields and CPEs are unavailable in the bundle. No patch details or exploitation evidence are provided, so avoid expanding scope beyond the cited description.
Mitigation direction
- Check 1C-Bitrix guidance for fixed versions or vendor-approved workarounds.
- Restrict Bitrix24 administrator access to trusted users and networks.
- Rotate SMTP credentials if administrator misuse or compromise is suspected.
- Review outbound HTTP controls from Bitrix24 administrative workflows.
- Harden administrator authentication with MFA and least privilege.
Validation and detection
- Inventory Bitrix24 deployments and confirm whether version 23.300.100 is present.
- Review who can administer SMTP settings in Bitrix24.
- Audit administrative activity around SMTP configuration changes.
- Check logs for unusual outbound HTTP POST activity from Bitrix24 systems.
- Confirm SMTP credentials have not been reused across services.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-522: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-34882 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N2.34CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/DrieVlad/BitrixVulnsCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.