CVE-2023-30791CWE-434

Plane 0.7.1 - Insecure file upload

High · published July 15, 2023

CVSS v3.1
7.1
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00530 · 43.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2023-07-15T18:41Z
EPSS history
Timeline
  • 15 JUL 18:41Z
    Plane 0.7.1 - Insecure file upload
    cvelistv5