CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-47830

High Severity
Plane
SVRS
56/100
CVSSv3
5.8/10
EPSS
0.00032/1

CVE-2024-47830 affects the Plane open-source project management tool, potentially allowing server-side request forgery (SSRF). The vulnerability stems from insecure wildcard support in /web/next.config.js, enabling attackers to force the server to make requests to arbitrary locations. Despite a moderate CVSS score of 5.8, the SOCRadar Vulnerability Risk Score (SVRS) is 56, suggesting a potentially underestimated risk profile. This SSRF vulnerability could enable attackers to access internal resources, potentially leading to data breaches or further compromise. Organizations using Plane should upgrade to version 0.23.0 to mitigate this risk. Failing to patch this CVE can expose sensitive internal data and systems. The ability to control server-side requests makes this a significant security concern.

TAGS
No tags available
VECTOR STRING
CVSS:3.1
AV:N
AC:L
PR:N
UI:N
S:C
C:N
I:L
A:N
PUBLICATION DATE2024-10-11
LAST MODIFIED2024-11-12
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-47830 is a vulnerability in Plane, an open-source project management tool. The vulnerability allows an attacker to induce the server side into performing requests to unintended locations by using the ** wildcard support to retrieve the image from any hostname. This vulnerability is fixed in version 0.23.0.

Key Insights

  • The CVSS score of 9.3 indicates that this vulnerability is critical and requires immediate attention.
  • The SVRS score of 38 indicates that this vulnerability is not as severe as other vulnerabilities with higher scores.
  • This vulnerability is not currently being exploited in the wild.

Mitigation Strategies

  • Update Plane to version 0.23.0 or later.
  • Restrict access to the affected server.
  • Implement a web application firewall (WAF) to block malicious requests.

Additional Information

  • This vulnerability is not associated with any known threat actors or APT groups.
  • CISA has not issued a warning about this vulnerability.
  • If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-47830 | makeplane up to 0.22.x Wildcard /web/next.config.js server-side request forgery (GHSA-39gx-38xf-c348)
vuldb.com2024-11-13
CVE-2024-47830 | makeplane up to 0.22.x Wildcard /web/next.config.js server-side request forgery (GHSA-39gx-38xf-c348) | A vulnerability, which was classified as critical, has been found in makeplane plane up to 0.22.x. Affected by this issue is some unknown functionality of the file /web/next.config.js of the component Wildcard Handler. The manipulation leads to server-side request forgery. This vulnerability is handled as <a href
vuldb.com
rss
forum
news

Social Media

CVE-2024-47830 (CVSS:9.3, CRITICAL) is Received. Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostn..https://t.co/VbJIxuYcTd #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
0
0
0
CVE-2024-47830 Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit… https://t.co/z4WA4tjt7I
0
0
1

Affected Software

Configuration 1
TypeVendorProduct
AppPlaneplane

References

ReferenceLink
[email protected]https://github.com/makeplane/plane/commit/b9f78ba42b70461c8c1d26638fa8b9beef6a96a1
[email protected]https://github.com/makeplane/plane/security/advisories/GHSA-39gx-38xf-c348
GITHUBhttps://github.com/makeplane/plane/security/advisories/GHSA-39gx-38xf-c348

CWE Details

CWE IDCWE NameDescription
CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence