CVE-2023-30791
Plane 0.7.1 - Insecure file upload
Résumé
Plane 0.7.1 - Insecure file upload
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.
Références
- advisory fluidattacks.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com