ProjectSend: The Unpatched Comedy of Errors – 55% Still Vulnerable!
VulnCheck warns that ProjectSend servers are being exploited due to an unpatched vulnerability, CVE-2024-11680. Described as an improper authentication flaw, it lets attackers create rogue accounts and execute malicious code. Despite a patch, most servers remain unprotected, making exploitation widespread—like a party where only hackers RSVP’d.
Hot Take:
This is why you should never underestimate the power of procrastination. It seems like ProjectSend admins are in a race to see who can avoid patching their servers the longest. Who knew that “I’ll do it tomorrow” could be so enticing to hackers?
Key Points:
- ProjectSend servers are being exploited due to an unpatched vulnerability from 2023.
- The issue, CVE-2024-11680, is an improper authentication flaw with a CVSS score of 9.8.
- Exploitation allows attackers to modify configurations and execute arbitrary PHP code.
- Despite available patches, 99% of servers haven’t updated, leaving them at risk.
- VulnCheck reports widespread exploitation and a significant lack of patch adoption.
Already a member? Log in here