ACTIEF MISBRUIKT
CVE-2024-11680: ProjectSend Improper Authentication Vulnerability
| Leverancier | ProjectSend |
|---|---|
| Product | ProjectSend |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 3 dec 2024 |
| CISA-deadline (Amerikaanse overheid) | 24 dec 2024 |
| Zwakte (CWE) | CWE-287 |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Beschrijving (NVD, Engels)
ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
BRONNEN
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.