CVE-2022-43959

Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP administrative password by reading the source code of /bitrix/admin/ldap_server_edit.php.

• CWE-200
• CWE-200

• https://github.com/secware-ru/CVE-2022-43959Exploit, Third Party Advisory
• https://www.bitrix24.com/prices/self-hosted.phpVendor Advisory
• https://www.bitrix24.com/security/Vendor Advisory
• https://github.com/secware-ru/CVE-2022-43959Exploit, Third Party Advisory
• https://www.bitrix24.com/prices/self-hosted.phpVendor Advisory
• https://www.bitrix24.com/security/Vendor Advisory

Published

Jan 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-43951An exposure of sensitive information to an unauthorized acto…7.5
• CVE-2022-43952An improper neutralization of input during web page generati…5.4
• CVE-2022-43953A use of externally-controlled format string in Fortinet For…7.8
• CVE-2022-43954An insertion of sensitive information into log file vulnerab…6.5
• CVE-2022-43955An improper neutralization of input during web page generati…6.1
• CVE-2022-43958A vulnerability has been identified in QMS Automotive (All v…7.6
• CVE-2022-4396A vulnerability was found in RDFlib pyrdfa3 and classified a…5.4
• CVE-2022-43967Concrete CMS (formerly concrete5) below 8.5.10 and between 9…6.1
• CVE-2022-43968Concrete CMS (formerly concrete5) below 8.5.10 and between 9…6.1
• CVE-2022-43969Ricoh mp_c4504ex devices with firmware 1.06 mishandle creden…9.1
• CVE-2022-4397A vulnerability was found in morontt zend-blog-number-2. It …6.5
• CVE-2022-43970A buffer overflow vulnerability exists in Linksys WRT54GL Wi…7.2