ProjectSend Improper Authentication Vulnerability

Added Dec. 3, 2024 • Due Dec. 24, 2024 • CVE-2024-11680

Overdue ProjectSend / ProjectSend CWE-287

Description

ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744
https://nvd.nist.gov/vuln/detail/CVE-2024-11680

Additional Information

Catalog Version: 2025.01.24
Catalog Released: Jan. 24, 2025
Days Until Due: 0 days
Last Updated: 4 months, 2 weeks ago