The vulnerability CVE-2024-34887 affects 1C-Bitrix Bitrix24 version 23.300.100 and involves insufficient protection of credentials in Active Directory/LDAP server settings. Remote administrators with high privileges can exploit this weakness to send AD/LDAP administrator account passwords to an attacker-controlled server using an HTTP POST request. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are high, no user interaction, scope changed, and high confidentiality impact with no integrity or availability impact.

An attacker with remote administrator privileges can exfiltrate sensitive AD/LDAP administrator passwords, potentially compromising directory services and related authentication systems. The confidentiality of these credentials is severely impacted, but integrity and availability are not directly affected. This could lead to further unauthorized access or lateral movement within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote administrator privileges to trusted personnel only and monitor for unusual outbound HTTP POST requests from the affected system. Avoid exposing AD/LDAP server settings to untrusted networks.