{"id":"CVE-2024-11680","kind":"vulnerability","aliases":["CVE-2024-11680"],"related":[],"title":"ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability","description":"ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"ProjectSend, a self-hosted file-sharing web application, has an authentication flaw in options.php that lets anyone change its configuration over HTTP without logging in. An attacker can create accounts, upload webshells for remote code execution, and inject malicious JavaScript.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-12-03T00:00:00+00:00","products":[{"name":"ProjectSend ProjectSend","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"projectsend","fixed":["r1720"],"affected":"< r1720","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","package","php","projectsend","self-hosted"],"not_affected_if":["managed-hosting","not-installed"],"how_to_check":null,"fix":"Apply the vendor mitigation per CISA guidance, or take ProjectSend offline if no mitigation exists; fixed version unknown from sources.","status":"open","published_at":"2024-11-26T10:15:04+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:04+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:56:04Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per CISA guidance, or take ProjectSend offline if no mitigation exists; fixed version unknown from sources.","reach":"internet","impact":"high","summary":"ProjectSend, a self-hosted file-sharing web application, has an authentication flaw in options.php that lets anyone change its configuration over HTTP without logging in. An attacker can create accounts, upload webshells for remote code execution, and inject malicious JavaScript.","category":"package","who_cares":["projectsend","self-hosted","php"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker uploads webshell and runs code on the server","analyst_note":"Find the vendor advisory and fixed version, and a way to check whether options.php was modified; source only links the KEV search page.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-installed","managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000465,"input_tokens":2867,"output_tokens":357,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-11680':15A,18A '-2024':14A,17A 'account':60B,104C 'action':113C 'affect':7A 'allow':78C,100C 'anyon':47B 'appli':114C 'applic':38B,89C 'attack':57B,82C,101C 'authent':11A,41B,75C 'chang':48B 'cisa':111C 'code':65B 'configur':50B,91C 'contain':72C 'craft':93C 'creat':59B,103C 'cve':13A,16A 'discontinu':120C 'emb':108C 'enabl':84C 'execut':66B 'exploit':22B,99C 'file':35B 'file-shar':34B 'flaw':42B 'host':28B,33B 'http':52B,94C 'improp':10A,74C 'inject':68B 'instruct':118C 'javascript':70B,110C 'let':46B 'log':54B 'malici':69B,109C 'mitig':115C,126C 'modif':86C 'options.php':44B,97C 'packag':23B 'per':116C 'php':24B 'prior':3A 'product':124C 'projectsend':1A,19A,20A,21A,25B,29B,71C 'r1720':5A 'remot':64B,80C 'request':95C 'requir':112C 'self':27B,32B 'self-host':26B,31B 'share':36B 'success':98C 'unauthent':81C 'unauthor':85C 'unavail':128C 'upload':61B,105C 'use':121C 'vendor':117C 'version':2A 'via':92C 'vulner':12A,76C 'web':37B 'webshel':62B,106C 'without':53B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-11-26T10:15:04+00:00","kev":{"dateAdded":"2024-12-03","dueDate":"2024-12-24","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-11680","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680","severity":null,"published_at":"2024-12-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-11680","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11680","severity":null,"published_at":"2024-11-26T10:15:04+00:00","modified_at":"2026-07-14T23:17:13+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}