PT-2025-4302 · Plane · Plane

I4Bdullah · Publicado 2025-01-06 · Atualizado 2025-01-07 · CVE-2025-21616

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 0.23

Description A cross-site scripting (XSS) vulnerability has been identified in Plane. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

Recommendations For versions prior to 0.23, update to version 0.23 or later to resolve the issue. As a temporary workaround, consider disabling the ability to upload SVG files as profile images until a patch is available. Restrict access to the profile image feature to minimize the risk of exploitation. Avoid using the profile image feature with SVG files until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-21616

GHSA-RCG8-G69V-X23J

Produtos afetados

Plane

Referências · 8

• 🔥 https://github.com/makeplane/plane/security/advisories/GHSA-rcg8-g69v-x23j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21616.json · Exploit
• https://t.me/thedarkwebinformer/10097 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-21616 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-21616 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1876382471073247649 · Publicação no Twitter
• https://t.me/cvedetector/14409 · Publicação no Telegram
• https://twitter.com/i4bdullah/status/1876359130736463912 · Publicação no Twitter