CVE-2024-11680

🗓️ 26 Nov 2024 09:55:23Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 383 Views

ProjectSend versions prior to r1720 have improper authentication allowing remote, unauthenticated attackers to modify application configuration and perform unauthorized actions

Reporter	Title	Published	Views	Family All 27
GithubExploit	Exploit for Missing Authentication for Critical Function in Projectsend	31 Mar 202612:10	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Projectsend	4 Dec 202418:42	–	githubexploit
attackerkb	CVE-2024-11680	26 Nov 202400:00	–	attackerkb
BDU FSTEC	ProjectSend Authentication Bypass	29 Nov 202400:00	–	bdu_fstec
Circl	CVE-2024-11680	21 Nov 202417:59	–	circl
CISA KEV Catalog	ProjectSend Improper Authentication Vulnerability	3 Dec 202400:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	3 Dec 202412:00	–	cisa
CNNVD	ProjectSend security vulnerability	26 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-11680 ProjectSend Unauthenticated Configuration Modification	26 Nov 202409:55	–	cvelist
Kitploit	CVE-2024-11680_PoC_Exploit	31 Oct 202623:46	–	kitploit

NVD

CNA

Node

projectsend projectsendRange<r1720

[
  {
    "defaultStatus": "unaffected",
    "packageURL": "pkg:github/projectsend/projectsend",
    "product": "ProjectSend",
    "programFiles": [
      "options.php"
    ],
    "repo": "https://github.com/projectsend/projectsend",
    "vendor": "ProjectSend",
    "versions": [
      {
        "lessThan": "r1720",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744
vulncheck	www.vulncheck.com/advisories/projectsend-bypass
github	www.github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml
synacktiv	www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog