PT-2025-22443 · Plane · Plane

I4Bdullah · Published 2025-05-21 · Updated 2025-05-22 · CVE-2025-48070

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 0.23

Description The issue concerns insecure permissions in the UserSerializer that allow users to modify fields intended to be read-only, such as the email. This can potentially lead to account takeover when combined with another issue like cross-site scripting (XSS).

Recommendations For versions prior to 0.23, update to version 0.23 to resolve the issue. As a temporary workaround, consider restricting access to the UserSerializer to prevent unauthorized changes to read-only fields.

Exploit

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-48070

GHSA-CJH4-Q763-CC48

Affected Products

Plane

References · 7

• 🔥 https://github.com/makeplane/plane/security/advisories/GHSA-cjh4-q763-cc48 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48070.json · Exploit
• https://github.com/makeplane/plane/commit/0a8cc24da505fd519fcc3c9d6b5e15bc7ce21b29 · Patch
• https://osv.dev/vulnerability/CVE-2025-48070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48070 · Security Note
• https://twitter.com/CVEnew/status/1925319704509653234 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1925383704970445097 · Twitter Post