CVE-2023-30791: Plane 0.7.1 - Insecure file upload
Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-30791?
CVE-2023-30791 is considered a moderate severity vulnerability due to its potential for unauthorized access and execution of arbitrary code.
How do I fix CVE-2023-30791?
To fix CVE-2023-30791, upgrade Plane to the latest version that does not allow HTML file uploads or implement input validation to restrict file types.
What types of attacks are possible with CVE-2023-30791?
CVE-2023-30791 allows attackers to upload malicious HTML and JavaScript files that may lead to cross-site scripting (XSS) attacks.
Who is affected by CVE-2023-30791?
CVE-2023-30791 affects users of Plane version 0.7.1-dev who utilize the avatar changing feature.
What are the implications of CVE-2023-30791 for user data?
CVE-2023-30791 can compromise user data security by allowing attackers to execute scripts in the context of users' browsers.