The vulnerability CVE-2024-34882 affects 1C-Bitrix Bitrix24 version 23.300.100 and involves insufficient protection of SMTP server credentials. Remote administrators with high privileges can exploit this issue to send SMTP account passwords to an arbitrary external server using an HTTP POST request. This represents a confidentiality breach (CWE-522) with no impact on integrity or availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope change with high confidentiality impact.

Successful exploitation allows remote administrators to exfiltrate SMTP account passwords, compromising the confidentiality of these credentials. This could lead to unauthorized use of SMTP accounts for sending emails, potentially facilitating further attacks or data leakage. There is no direct impact on system integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote administrator access to trusted personnel only and monitor for unusual HTTP POST requests that may indicate credential exfiltration attempts.