CVE-2024-31461: Plane Server-Side Request Forgery (SSRF) Vulnerability

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-10 · updated 2026-06-17
Weakness: CWE-918

Description

Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized access to internal systems. The impact of this vulnerability includes, but is not limited to, unauthorized access to internal services accessible from the server, potential leakage of sensitive information from internal services, manipulation of internal systems by interacting with internal APIs. Version 0.17-dev contains a patch for this issue. Those who are unable to update immediately may mitigate the issue by restricting outgoing network connections from servers hosting the application to essential services only and/or implementing strict input validation on URLs or parameters that are used to generate server-side requests.

Affected products

makeplane Plane: before 0.17-dev — fixed in 0.17-dev

How to fix

Upgrade to a fixed version: makeplane Plane 0.17-dev. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-31461 or the next vulnerability affects your stack