Exploitation ongoing with high activity in latest observed window (4 mentions)
Recommended action window: Immediate (within 24h)
NVD description
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-12-24. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2024-11680: CISA adds CVE-2024-11680: unauthenticated options.php config change in ProjectSend enables account creation, webshell uploads, malicious JS.
Post summary
CISA announces CVE-2024-11680, an unauthenticated configuration change in ProjectSend’s options.php that allows creation of accounts, webshell uploads, and malicious JavaScript.
What happened CISA added CVE-2024-11680 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-12-03, signaling observed exploitation in the wild CISA KEV. The issue is an improper authentication bug in ProjectSend that allows unauthenticated changes to application…
Post summary
CISA listed CVE-2024-11680 in its KEV catalog, confirming that the improper authentication flaw in ProjectSend is being actively exploited in the wild.
NVD tracks the flaw as CVE-2024-11680 and maps it to CWE-287 (Improper Authentication) NVD entry. The MITRE CVE record aligns on the identifier and vulnerability class MITRE CVE. CISA set a remediation due date of 2024-12-24 for covered entities CISA KEV.
Post summary
The post simply reports the existence, CVE and CWE identifiers, and a CISA remediation due date, but offers no PoC, exploitation, patch, or false‑positive information.
https://research.lyrie.ai/research/active-exploit-cve-2024-11680-projectsend #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The research link indicates that CVE-2024-11680 in ProjectSend has an active exploit, implying both PoC and real‑world exploitation, but lacks details on patches or technical specifics.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | projectsend | projectsend | - | - | - |