CVE-2024-11680: projectsend

csirt@kutim:~/threat-intel/cve/CVE-2024-11680

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 91,8%

Kerentanan Missing Authentication for Critical Function pada projectsend. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 Desember 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Rincian

Terbit di NVD: 26 November 2024
Terakhir diubah: 14 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-306: Missing Authentication for Critical Function
EPSS (30 hari): 91,8% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: ProjectSend Improper Authentication Vulnerability
Masuk KEV: 3 Desember 2024
Tenggat CISA: 24 Desember 2024 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
projectsend	projectsend	Semua versi sebelum r1720

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744 patch
https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf mitigasi · deskripsi teknis · advisory pihak ketiga
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680 pemerintah AS
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.ya... broken link · advisory pihak ketiga
https://vulncheck.com/advisories/projectsend-bypass advisory pihak ketiga
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.... exploit

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.