CVE-2023-30791 | THREATINT

Description

Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.

Reserved 2023-04-17 | Published 2023-07-15 | Updated 2024-10-30 | Assigner Fluid Attacks

HIGH: 7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Default status

unaffected

0.7.1

affected

References

fluidattacks.com/advisories/indio/

github.com/makeplane/plane

cve.org (CVE-2023-30791)

nvd.nist.gov (CVE-2023-30791)

Download JSON