← Back

CVE-2024-11680

nvd nistnuclei
Published: Nov 26, 2024Modified: Jul 14, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Affected (1)

Projectsend
1 product
Projectsend
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Projectsend
Before r1720

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (6)

Source: disclosure@vulncheck.com
Broken LinkThird Party Advisory
Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
Exploit
Source: disclosure@vulncheck.com
Third Party Advisory
Source: disclosure@vulncheck.com
MitigationTechnical DescriptionThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.