CVE-2023-53930highCWE-639

CVE-2023-53930: high-severity vulnerability in projectSend

ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability

Published · Updated

Follow this CVE+ Monitor ProjectSend

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
projectSend · projectSend
Related CVEs — projectSend

In the same product, most dangerous first.

CVE-2023-53905MEDIUMProjectSend r1605 CSV Injection via User Account Export FunctionalityEPSS 0.5%CVE-2023-53906MEDIUMProjectSend r1605 Stored Cross-Site Scripting via Custom Assets PageEPSS 0.3%