All vulnerabilities
CVE-2024-11680

ProjectSend Improper Authentication Vulnerability

ProjectSend ProjectSend
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 3 Dec 2024CISA KEV
Exploit odds (EPSS)91.8%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline24 Dec 2024Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 19 Jul 2024Exploit code publicMetasploit
  2. 26 Nov 2024, 09:55 UTCPublishedCVE List
  3. 3 Dec 2024Added to CISA KEVCISA KEV

Public exploit code and templates 2

  • Exploit moduleProjectSend r1295 - r1605 Unauthenticated Remote Code Execution 19 Jul 2024Metasploit
  • Scanner templateProjectSend <= r1605 - Improper AuthorizationNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Text from CVE List

Affected versions 1

  • ProjectSendaffected: all versions before r1720CVE List

References 7