ProjectSend Unauthenticated Configuration Modification
100Vexday Risk Score
Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.
ssvc Actcvss 9.8epss 92%
da publicação à arma8 dias
Publicada no NVD26 de nov.
1ª PoC+8d
metasploit19 de jul.
CISA KEV+7d
probabilidade de exploração
92%top 1% das CVEs
exploração observada
simCISA + VulnCheck
7 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2024-12-24
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
ProjectSend · ProjectSendPoCs públicas encontradas — 7
githubgithub.com/D3N14LD15K/CVE-2024-11680_PoC_Exploit★ 12githubgithub.com/qucklecrabik/CVE-2024-11680★ 0cve_referencegithub.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rbnão verificadocve_referencewww.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdfnão verificadocve_referencegithub.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yamlnão verificadovulncheckvulncheck.com/xdb/a7d6dcb1ffacnão verificadovulncheckvulncheck.com/xdb/a4426af4686bnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yamlhttps://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rbhttps://vulncheck.com/advisories/projectsend-bypasshttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf