PatchTheCVEbitrix24 vulnerabilities and fixes
Recent CVEs affecting bitrix24, with upgrade or downgrade steps. 5 tracked.
bitrix24 has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2024-11-04. Highest priority: CVE-2024-34885 (score 38/100).
- CVE-2024-34891 MEDIUM 6.8 DOWNGRADE Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote adm
- CVE-2024-34887 MEDIUM 4.9 DOWNGRADE Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote
- CVE-2024-34885 MEDIUM 6.8 DOWNGRADE Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote ad
- CVE-2024-34883 MEDIUM 4.9 DOWNGRADE Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote admi
- CVE-2024-34882 MEDIUM 4.9 DOWNGRADE Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote ad
FAQ
How do I fix bitrix24 vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is bitrix24 being exploited right now?
None of the tracked bitrix24 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which bitrix24 CVE should I patch first?
CVE-2024-34885 currently ranks highest (38/100): Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote ad.