Detections
Analytics
ProjectSend < r1720 Improper Authorization
critical Web App Scanning Plugin ID 114977
Language:
Synopsis
ProjectSend < r1720 Improper AuthorizationDescription
ProjectSend version prior to r1720 is affected by an Improper Authorization vulnerability. An unauthenticated attacker can exploit this issue to access sensitive information and perform unauthorized actions within the application.Solution
Upgrade to ProjectSend version r1720 or later.See Also
Plugin Details
Severity: Critical
ID: 114977
Type: remote
Family: Component Vulnerability
Published: 10/3/2025
Updated: 10/3/2025
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: High
Score: 8.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-11680
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2024-11680
Vulnerability Information
CPE: cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/3/2024
Vulnerability Publication Date: 11/25/2024
CISA Known Exploited Vulnerability Due Dates: 12/24/2024
Reference Information
CVE: CVE-2024-11680
CWE: 306
OWASP: 2010-A3, 2013-A2, 2013-A9, 2017-A2, 2017-A9, 2021-A6, 2021-A7
WASC: Insufficient Authentication
DISA STIG: APSC-DV-000460, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a), 164.312(e)
ISO: 27001-A.14.2.5, 27001-A.9.1.2, 27001-A.9.2.3, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-6(1), sp800_53-CM-6b
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-3.7.1
PCI-DSS: 3.2-6.2, 3.2-6.5.10