PT-2024-38486 · Unknown · Projectsend

Casp3R0X0 + 1 · Published 2024-08-11 · Updated 2025-01-13 · CVE-2024-7658

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProjectSend versions up to r1605

Description A vulnerability has been found in ProjectSend, affecting the get preview function of the process.php file. This issue leads to improper control of resource identifiers and can be initiated remotely. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited.

Recommendations For ProjectSend versions up to r1605, upgrade to version r1720 to address this issue. As a temporary workaround, consider disabling the get preview function of the process.php file until the patch is applied. Restrict access to the process.php file to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-99

Related Identifiers

CVE-2024-7658

Affected Products

Projectsend

References · 10

• https://github.com/projectsend/projectsend/releases/tag/r1720 · Patch
• https://github.com/projectsend/projectsend/commit/eb5a04774927e5855b9d0e5870a2aae5a3dc5a08 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-7658 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7658 · Vendor Advisory
• https://t.me/cvenotify/90369 · Telegram Post
• https://vuldb.com/?submit.385000 · Note
• https://vuldb.com/?ctiid.274115 · Note
• https://vuldb.com/?id.274115 · Note
• https://twitter.com/VulmonFeeds/status/1823021925183975646 · Twitter Post
• https://kiyell.com/private-files-from-projectsend-idor · Note