CVE-2024-47830

Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0.

• CWE-918
• CWE-918

• https://github.com/makeplane/plane/commit/b9f78ba42b70461c8c1d26638fa8b9beef6a96a1Patch
• https://github.com/makeplane/plane/security/advisories/GHSA-39gx-38xf-c348Exploit, Vendor Advisory

Published

Oct 11, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47825Cilium is a networking, observability, and security solution…8.7
• CVE-2024-47826eLabFTW is an open source electronic lab notebook for resear…6.1
• CVE-2024-47827Argo Workflows is an open source container-native workflow e…4.8
• CVE-2024-47828ampache is a web based audio/video streaming application and…6.5
• CVE-2024-47829pnpm is a package manager. Prior to version 10.0.0, the path…6.5
• CVE-2024-4783The jQuery T(-) Countdown Widget plugin for WordPress is vul…6.4
• CVE-2024-47831Next.js is a React Framework for the Web. Cersions on the 10…7.5
• CVE-2024-47832ssoready is a single sign on provider implemented via docker…9.8
• CVE-2024-47833Taipy is an open-source Python library for easy, end-to-end …6.5
• CVE-2024-47834GStreamer is a library for constructing graphs of media-hand…9.1
• CVE-2024-47835GStreamer is a library for constructing graphs of media-hand…7.5
• CVE-2024-47836Admidio is an open-source user management solution. Prior to…4.3