PT-2024-38487 · Unknown · Projectsend

Casp3R0X0 · Published 2024-08-11 · Updated 2024-08-15 · CVE-2024-7659

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProjectSend versions up to r1605

Description A vulnerability was found in the Password Reset Token Handler component, specifically in the generate random string function of the file includes/functions.php. This issue leads to insufficiently random values, which can be exploited remotely. The complexity of an attack is rather high, and the exploitability is difficult.

Recommendations For versions up to r1605, upgrade to version r1720 to address this issue. As a temporary workaround, consider restricting the use of the generate random string function in the Password Reset Token Handler until the upgrade is applied.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2024-7659

Affected Products

Projectsend

References · 8

• https://github.com/projectsend/projectsend/commit/aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17 · Patch
• https://github.com/projectsend/projectsend/releases/tag/r1720 · Patch
• https://osv.dev/vulnerability/CVE-2024-7659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7659 · Security Note
• https://twitter.com/VulmonFeeds/status/1823017368005554214 · Twitter Post
• https://vuldb.com/?id.274116 · Note
• https://vuldb.com/?submit.385004 · Note
• https://vuldb.com/?ctiid.274116 · Note