CVE-2023-30791 — Plane 0.7.1 - Insecure file upload

CVE-2023-30791

Plane 0.7.1 - Insecure file upload PUBLISHED

Description (CNA)

Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.

Affected (CNA)

Vendor / product	Versions
Plane / Plane	affected 0.7.1

CWE

CWE-434

References

https://fluidattacks.com/advisories/indio/
https://github.com/makeplane/plane

ADP enrichment

CVE

No English description supplied.

https://fluidattacks.com/advisories/indio/
https://github.com/makeplane/plane

CISA-ADP

No English description supplied.

No references supplied.