Russian Vulnerability Scanner Database

Back to List

CVE-2024-11680

Scores

EPSS

0.935high93.5%
0%20%40%60%80%100%

Percentile: 93.5%

CVSS

9.8critical3.x
0246810

CVSS Score: 9.8/10

All CVSS Scores

CVSS 3.x
9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application’s configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

anchore_overridesnvd

CWEs

287CWE-306

Related Vulnerabilities

BDU:2024-10433

Exploits

Exploit ID: CVE-2024-11680

Source: cisa

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Vulnerable Software (2)

Type: Configuration

Operating System:

Trait: 
{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*",          "versionEndExcluding": "r1720"        }      ],      "neg...

Source: anchore_overrides

Type: Configuration

Vendor: *

Product: projectsend

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*",      "versionEndExcluding": "r1720",      "vulnerable": true    }  ],  "operator": "OR"}

Source: nvd

End of list