PT-2023-18624 · Plane · Plane

Lautaro Casanova · Published 2023-07-15 · Updated 2024-09-05 · CVE-2023-2268

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plane version 0.7.1

Description The issue allows an unauthenticated attacker to view all stored server files of all users.

Recommendations For Plane version 0.7.1, update to a version that contains a fix for this issue, as the current version allows unauthorized access to sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-2268

Affected Products

Plane

References · 8

• 🔥 https://fluidattacks.com/advisories/giardino · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2268 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2268 · Vendor Advisory
• https://github.com/makeplane/plane · Note
• https://t.me/cibsecurity/66775 · Telegram Post
• https://t.me/cvenotify/54449 · Telegram Post
• https://t.me/cvenotify/93486 · Telegram Post
• https://twitter.com/fluidattacks/status/1689040287664939008 · Twitter Post