CVE-2023-30791
Plane 0.7.1 - Insecure file upload
Summary
Plane 0.7.1 - Insecure file upload
Original description
The description as published by the source.
Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.
References
- advisory fluidattacks.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com