{"basis":"claimed","id":"CVE-2024-11680","name":"ProjectSend Improper Authentication Vulnerability","vendorProject":"ProjectSend","product":"ProjectSend","publishedAt":"2024-11-26","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2024-12-03","dueDate":"2024-12-24","ransomware":false},"epss":{"score":0.91849,"percentile":0.99816,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-01-06","daysToRule":41},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"ProjectSend Unauthenticated Configuration Modification","description":"ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.","cwes":["CWE-306"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-01-06","firstIsNew":true,"daysToRule":41,"daysAtMost":null,"freePlan":false,"claims":[{"id":"0a8f13062277e6081520e66baeb9b410b19e780c1a1cabb286102d86548b69e4","cve_id":"CVE-2024-11680","vendor":"cloudflare","product":"Cloudflare Specials","rule_id":"19587024724e49329d5b482d0d7ca374","rule_name":"ProjectSend - Remote Code Execution - CVE:CVE-2024-11680","change":"new","default_action":"Block","published_on":"2025-01-06","source_url":"https://developers.cloudflare.com/changelog/post/2025-01-06-waf-release/","source_title":"WAF Release - 2025-01-06","excerpt":"ProjectSend - Remote Code Execution - CVE:CVE-2024-11680. Previous action: Log. New action: Block. New Detection","first_seen_at":"2026-11-02T21:00:16.956Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:42.096Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2024-11680","templatePath":"http/cves/2024/CVE-2024-11680.yaml","requests":5,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/options.php","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/options.php","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"passed","templateId":"CVE-2024-11680","templatePath":"http/cves/2024/CVE-2024-11680.yaml","requests":5,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/options.php","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/options.php","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}