Vulnerability · Published Aug 11, 2024 · Assigned by VulDB

CVE-2024-7658projectsend process.php get_preview resource injection

Medium 5.3

In plain English

A medium-severity security flaw in projectsend. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.8%top 43.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
n/a	projectsend	r1605

Weakness: CWE-99 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

VDB-274115 | projectsend process.php get_preview resource injection vdb-entry, technical-description
VDB-274115 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #385000 | ProjectSend ProjectSend file sharing web application r1605 Insecure direct object references third-party-advisory
https://github.com/projectsend/projectsend/commit/eb5a04774927e5855b9d0e5870a2aae5a3dc5a08 patch
https://github.com/projectsend/projectsend/releases/tag/r1720 patch
https://www.kiyell.com/private-files-from-projectsend-idor/