CVE-2024-7658

Katalog CVE

CVSS 5.3 · Medium EPSS 0,79%

Kerentanan Improper Control of Resource Identifiers ('Resource Injection') pada projectsend. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

12 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-99: Improper Control of Resource Identifiers ('Resource Injection')
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/projectsend/projectsend/commit/eb5a04774927e5855b9d0e5870a2aae5a3dc5a08 patch
• https://vuldb.com/?id.274115 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.385000 advisory pihak ketiga · vdb entry
• https://github.com/projectsend/projectsend/releases/tag/r1720 release notes
• https://vuldb.com/?ctiid.274115 permissions required · vdb entry
• https://www.kiyell.com/private-files-from-projectsend-idor/