CVE-2024-11680
CriticalActively exploited (CISA KEV)
Description
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
SeverityCritical
CVSS9.8
Exploit probability—
ProductProjectSend
PublishedNov 26, 2024
First seenNov 26, 2024
Added to KEVDec 3, 2024
Weakness typeCWE-306Missing authentication for critical function
How to fix
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date: Dec 24, 2024Update
- projectsend projectsendr1720 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| projectsend projectsend | v < r1720 | r1720 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.