Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-43959 — Bitrix Vulnerability CVE-2022-43959 | Kitploit
Tools/GitHubGitHub/secware-ru/cve-2022-43959
Vulnerability AnalysisConfiguration AuditingWeb SecuritySecret DetectionAuthenticationMisconfiguration
GitHubsecware-ru/cve-2022-43959

CVE-2022-43959

Bitrix Vulnerability CVE-2022-43959

View Repository
43 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2022-43959

Bitrix Vulnerability CVE-2022-43959

Description

Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 AD/LDAP connector module before version 23.100.0 allow remote administrators to discover an AD/LDAP administrative password by reading the source code of /bitrix/admin/ldap_server_edit.php.

CVSS

LevelScoreCVSSLink
Medium4.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Nlink

Steps to reproduce:

  1. Get access to the Bitrix24 administrative panel.
  2. Go to the AD/LDAP settings item in the Administration section.
  3. Enter the AD/LDAP server settings from the list of servers.
  4. Go to the Server tab.
  5. Make sure that the password of the user with read access rights to the AD/LDAP server tree is masked in the “Password” line.
  1. Use the browser developer tools to view the source code of the bitrix/admin/ldap_server_edit.php page.
  2. Make sure that the password of the user with read access rights to the AD/LDAP server tree is displayed in clear text in the source code.

Reference

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43959

https://www.bitrix24.com/prices/self-hosted.php

https://www.bitrix24.com/security/

https://www.bitrix24.com/features/box/box-versions.php?module=ldap

Authors

Sergey Avdeev, Dmitry Lymbin (@lymbin) at Secware

Download Tool