CVE-2024-11680

Description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 9.8CVSS 3.1, Criticalfrom the CNA (VulnCheck)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What to do

• Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-114 Authentication Abuse (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 19 Jan 2023 Synactiv discloses to ProjectSend
2. 16 May 2023 ProjectSend patches the vulnerability
3. 19 Jul 2024 Synactiv releases an advisory
4. 3 Aug 2024 ProjectSend releases the official patch in r1720
5. 30 Aug 2024 A Metasploit pull request is opened
6. 3 Sep 2024 A Nuclei pull request is opened
7. 25 Nov 2024 A CVE is assigned
8. 26 Nov 2024 Published
9. 3 Dec 2024 CVE-2024-11680 added to CISA KEV
10. 3 Dec 2024 Added to the CISA KEV catalogue

Weakness

• CWE-306

References

• github.compatch
• www.synacktiv.comthird-party-advisoryexploit
• github.comexploit
• github.comexploit
• vulncheck.comthird-party-advisory