CVE-2022-43959

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-20 · updated 2026-06-17
Weakness: CWE-200

Description

Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP administrative password by reading the source code of /bitrix/admin/ldap_server_edit.php.

Affected products

Bitrix24: through 22.200.200

References

https://github.com/secware-ru/CVE-2022-43959
https://www.bitrix24.com/prices/self-hosted.php
https://www.bitrix24.com/security/
https://github.com/secware-ru/CVE-2022-43959
https://www.bitrix24.com/prices/self-hosted.php
https://www.bitrix24.com/security/

Get alerted when CVE-2022-43959 or the next vulnerability affects your stack