Lucene search
Fluid AttacksCVELIST:CVE-2023-30791HistoryJul 15, 2023 - 6:41 p.m.
CVE-2023-30791 Plane 0.7.1 - Insecure file upload
2023-07-1518:41:21
CWE-434
Fluid Attacks
www.cve.org
3
cve-2023-30791
plane 0.7.1
insecure file upload
html
javascript
CVSS3
7.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
23.8%
Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.
CNA Affected
[
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Plane",
"vendor": "Plane",
"versions": [
{
"status": "affected",
"version": "0.7.1"
}
]
}
]Related
prion
prion
Hardcoded credentials
2023-07-15 19:15:00
nvd
nvd
CVE-2023-30791
2023-07-15 19:15:09
cve
cve
CVE-2023-30791
2023-07-15 19:15:09
osv
osv
CVE-2023-30791
2023-07-15 19:15:09
CVSS3
7.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
23.8%
Related for CVELIST:CVE-2023-30791