Security readout for executives and security teams
Plain-English summary
This CVE describes Bitrix24 exposing stored Exchange account passwords in DAV server settings to remote administrators. The main business risk is credential disclosure: an already privileged Bitrix24 administrator could obtain Exchange credentials and potentially use them outside Bitrix24.
Executive priority
Treat this as a moderate-priority credential exposure issue. It is not shown as actively exploited, and it requires administrator privileges, but exposed Exchange passwords can create broader business impact if an admin account is compromised or misused.
Technical view
CVE-2024-34891 is CWE-312, insufficiently protected credentials. The CVSS 3.1 score is 6.8 with network access, low complexity, high privileges required, no user interaction, changed scope, and high confidentiality impact. The description names 1C-Bitrix Bitrix24 23.300.100 and DAV server settings.
Likely exposure
Exposure appears limited to environments running Bitrix24 23.300.100 where DAV server settings store Exchange account credentials and remote administrators can access the relevant settings. The affected-product metadata in the source bundle is incomplete.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. Abuse requires high privileges, but the disclosed material is sensitive because Exchange credentials may enable access beyond the original Bitrix24 setting.
Researcher notes
The source bundle gives a clear vulnerability description and CVSS vector but incomplete affected-product metadata and no named fix. Avoid assuming other Bitrix24 versions are affected unless vendor or additional public evidence confirms them.
Mitigation direction
- Check official 1C-Bitrix guidance for fixed versions or configuration mitigations.
- Upgrade affected Bitrix24 deployments if a vendor-fixed release is available.
- Rotate Exchange credentials stored in DAV server settings.
- Limit Bitrix24 administrative access to trusted administrators and management networks.
- Remove stored DAV or Exchange credentials where they are not required.
- Review logs for unusual administrative access to DAV server settings.
Validation and detection
- Inventory Bitrix24 deployments and confirm whether version 23.300.100 is present.
- Determine whether DAV server settings contain Exchange account credentials.
- Review administrative role assignments for unnecessary high-privilege users.
- Check access logs for remote administrative reads of DAV-related settings.
- Confirm Exchange password rotation completed after exposure assessment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-312: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-34891 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N2.34CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/DrieVlad/BitrixVulnsCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.