← CVE Radar
CVE-2024-11680ProjectSend Unauthenticated Configuration Modification
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
9.8 CRITICALEPSS 91.84%⚡ Known Exploited (CISA KEV)NVD: Published
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2024-11680
- Status
- Published
- Assigner (CNA)
- VulnCheck
- Published
- Nov 26, 2024
- Last modified
- 2026-07-14 22:54 UTC
Affected Products
As published by the CNA in the CVE record.
ProjectSendProjectSend1 version range
- before r1720
References
- github.com https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744
- synacktiv.com https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf
- github.com https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb
- github.com https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml
- vulncheck.com https://vulncheck.com/advisories/projectsend-bypass
Sources
- NVD (unavailable at last refresh)
- CVE.org
- CISA KEV
- FIRST EPSS