ProjectSend Unauthenticated Configuration Modification
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 9.8epss 92%
de la publicación al arma8 días
Publicada en NVD26 nov
1ª PoC+8d
metasploit19 jul
CISA KEV+7d
probabilidad de explotación
92%top 1% de las CVE
explotación observada
síCISA + VulnCheck
7 exploit(s) público(s)
Acción exigida por CISAplazo federal: 2024-12-24
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Investigado y redactado con IA a partir del advisory del fabricante y análisis públicos, con las fuentes citadas. Verifica siempre la versión corregida en el advisory oficial antes de actuar.
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
ProjectSend · ProjectSendPoCs públicas encontradas — 7
githubgithub.com/D3N14LD15K/CVE-2024-11680_PoC_Exploit★ 12githubgithub.com/qucklecrabik/CVE-2024-11680★ 0cve_referencegithub.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rbno verificadocve_referencewww.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdfno verificadocve_referencegithub.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yamlno verificadovulncheckvulncheck.com/xdb/a7d6dcb1ffacno verificadovulncheckvulncheck.com/xdb/a4426af4686bno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yamlhttps://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rbhttps://vulncheck.com/advisories/projectsend-bypasshttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf