Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
ProjectSend Incorrect Authorization Vulnerability - CVE-2024-11680 - Vulnerability Database
ProjectSend

ProjectSend Incorrect Authorization Vulnerability - CVE-2024-11680

Critical
Reference: CVE-2024-11680
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2024-11680
Title: ProjectSend Incorrect Authorization Vulnerability
Overview:

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php enabling unauthorized modification of the application39s configuration. Successful exploitation allows attackers to create accounts upload webshells and embed malicious JavaScript.