Security readout for executives and security teams
Plain-English summary
CVE-2024-34887 is a credential-protection weakness in 1C-Bitrix Bitrix24 23.300.100. A highly privileged remote administrator could cause AD/LDAP administrator passwords stored in server settings to be sent to an arbitrary server. The main business risk is exposure of directory credentials, not service outage or code execution.
Executive priority
Treat this as a moderate-priority credential exposure issue. Prioritize environments where Bitrix24 is integrated with AD/LDAP and administrators can access or modify directory settings.
Technical view
The CVE describes CWE-522: insufficiently protected credentials in AD/LDAP server settings. CVSS 3.1 is 6.8 with network access, low complexity, high privileges required, no user interaction, changed scope, and high confidentiality impact. Public affected-product metadata is incomplete, but the CVE title names Bitrix24 23.300.100.
Likely exposure
Organizations running Bitrix24 23.300.100 with AD/LDAP integration are the clearest concern. Exposure depends on who has Bitrix24 administrative access and whether AD/LDAP administrator credentials are stored in the product.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. The high-privilege requirement lowers broad internet exploitation risk, but a malicious, compromised, or overprivileged Bitrix24 administrator could create serious credential exposure.
Researcher notes
Public data is thin: affected metadata is listed as n/a, while the CVE title names Bitrix24 23.300.100. Do not assume other versions are affected without vendor or researcher confirmation. No exploit code or active exploitation is cited in the bundle.
Mitigation direction
- Check 1C-Bitrix guidance for fixed versions or official mitigations.
- Restrict Bitrix24 administrative access to trusted, necessary accounts only.
- Rotate AD/LDAP administrator passwords if exposure is suspected.
- Avoid storing highly privileged directory credentials where lower-privilege bind accounts are sufficient.
- Monitor outbound traffic from Bitrix24 servers to unapproved HTTP endpoints.
Validation and detection
- Identify whether Bitrix24 23.300.100 is deployed.
- Confirm whether AD/LDAP server settings are configured.
- Review which users have Bitrix24 administrator privileges.
- Check logs for AD/LDAP settings changes by administrators.
- Review outbound HTTP activity from Bitrix24 hosts to unusual destinations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-522: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-34887 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N2.34CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/DrieVlad/BitrixVulnsCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficiently Protected Credentials
Insufficiently Protected Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.