Critical severity · published Nov 26, 2024
CVE-2024-11680
ProjectSend Unauthenticated Configuration Modification
In wildKEV
9.8
CVSS
91.8%
EPSS
Yes
On KEV
Description
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)91.8% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 3, 2024
Federal remediation dueDec 24, 2024
Ransomware campaign useNot known
Affected products
Which versions
PR
ProjectSend · ProjectSend
before r1720 · source: vendor, NVD, CISA, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11680
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11680
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
patch
https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744
third-party-advisory
https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf
exploit
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb
exploit
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml
third-party-advisory
https://vulncheck.com/advisories/projectsend-bypass
More from ProjectSend
9.8
CVE-2023-53980
ProjectSend r1605 Remote Code Execution via File Extension Manipulation
9.8
CVE-2021-40887
Projectsend version r1295 is affected by a directory traversal vulnerability
9.8
CVE-2016-10734
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php
9.8
CVE-2016-10733
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string
9.8
CVE-2016-10732
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or…