CVE-2024-7659

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-7659
A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version r1720 is able to address this issue. The name of the patch is aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17. It is recommended to upgrade the affected component.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://vuldb.com/?id.274116 Permissions Required VDB Entry
https://vuldb.com/?ctiid.274116 Permissions Required VDB Entry
https://vuldb.com/?submit.385004 Third Party Advisory VDB Entry
https://github.com/projectsend/projectsend/commit/aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17 Patch
https://github.com/projectsend/projectsend/releases/tag/r1720 Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*
History

15 Aug 2024, 17:49

Type Values Removed Values Added
CPE cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://vuldb.com/?submit.385004 - () https://vuldb.com/?submit.385004 - Third Party Advisory, VDB Entry
References () https://github.com/projectsend/projectsend/commit/aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17 - () https://github.com/projectsend/projectsend/commit/aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17 - Patch
References () https://github.com/projectsend/projectsend/releases/tag/r1720 - () https://github.com/projectsend/projectsend/releases/tag/r1720 - Release Notes
References () https://vuldb.com/?id.274116 - () https://vuldb.com/?id.274116 - Permissions Required, VDB Entry
References () https://vuldb.com/?ctiid.274116 - () https://vuldb.com/?ctiid.274116 - Permissions Required, VDB Entry
First Time Projectsend projectsend
Projectsend
References () https://vuldb.com/?submit.385004 - () https://vuldb.com/?submit.385004 - Third Party Advisory, VDB Entry
References () https://github.com/projectsend/projectsend/commit/aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17 - () https://github.com/projectsend/projectsend/commit/aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17 - Patch
References () https://github.com/projectsend/projectsend/releases/tag/r1720 - () https://github.com/projectsend/projectsend/releases/tag/r1720 - Release Notes
References () https://vuldb.com/?id.274116 - () https://vuldb.com/?id.274116 - Permissions Required, VDB Entry
References () https://vuldb.com/?ctiid.274116 - () https://vuldb.com/?ctiid.274116 - Permissions Required, VDB Entry
CPE cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*
First Time Projectsend projectsend
Projectsend
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

12 Aug 2024, 13:41

Type Values Removed Values Added
CPE cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : unknown
New CVE
Information

Published : 2024-08-12 13:38

Updated : 2024-08-15 17:49

NVD link : CVE-2024-7659

Mitre link : CVE-2024-7659

JSON object : View

Products Affected

projectsend

  • projectsend
CWE
CWE-330

Use of Insufficiently Random Values