Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site scripting (XSS). Version 0.23 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/makeplane/plane/commit/0a8cc24da505fd519fcc3c9d6b5e15bc7ce21b29 | Patch |
| https://github.com/makeplane/plane/security/advisories/GHSA-cjh4-q763-cc48 | Exploit Vendor Advisory |
| https://github.com/makeplane/plane/security/advisories/GHSA-cjh4-q763-cc48 | Exploit Vendor Advisory |
Configurations
History
20 Jun 2025, 16:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/makeplane/plane/security/advisories/GHSA-cjh4-q763-cc48 - Exploit, Vendor Advisory | |
| References | () https://github.com/makeplane/plane/commit/0a8cc24da505fd519fcc3c9d6b5e15bc7ce21b29 - Patch | |
| CPE | cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| First Time |
Plane plane
Plane |
22 May 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
21 May 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-21 22:15
Updated : 2025-06-20 16:05
NVD link : CVE-2025-48070
Mitre link : CVE-2025-48070
JSON object : View
Products Affected
plane
- plane
CWE
No CWE.