ProjectSend: The File-Sharing Fiasco with a Vulnerability Punchline!
Public-facing ProjectSend instances are under attack! Despite a patch released in August, many servers are still vulnerable due to improper authentication. VulnCheck allocated CVE-2024-11680, giving it a critical CVSS score of 9.8. Only 1% of users are using the patched version, making ProjectSend a hot target for cyber mischief!
Hot Take:
ProjectSend, the open-source file-sharing app, has become a hacker’s playground thanks to an authentication vulnerability that’s more inviting than a free buffet! Despite the patch being out since May, it seems only 1% of users actually bothered to show up to the security party. Talk about being fashionably late!
Key Points:
- ProjectSend has an improper authentication vulnerability allowing remote access and modification.
- The vulnerability was reported in January 2024 but only got a patch in May 2024.
- Despite the patch, only 1% of users have updated, leaving many instances vulnerable.
- VulnCheck assigned a CVSS score of 9.8, labeling the flaw as highly critical.
- Hackers have been actively exploiting this vulnerability, changing landing page titles to suspicious strings.
Already a member? Log in here