CVE-2025-65922
Full vulnerability record from the local CVENow database.
Description
PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead to unintended modification of projects or tasks, it exposes users to Phishing attacks. Attackers can frame the legitimate Planka application on a malicious site to establish false trust (UI Redressing), potentially tricking users into entering sensitive information or credentials into overlaid fake forms. NOTE: this is disputed by the Supplier because "PLANKA uses SameSite=Strict cookies, preventing authentication in cross-origin contexts. No session can be established. No credential interception or unauthorized actions are possible. Browser Same-Origin Policy prevents the parent page from accessing iframe content. Clickjacking is not applicable on the login page. Any credential capture would require attacker-controlled input and user interaction equivalent to phishing. The security outcome depends entirely on the user's trust in the parent page. An attacker can achieve the same effect with a fully fake login page. Embedding the legitimate page adds no risk, as browsers do not show URL, certificate, or padlock indicators in cross-origin iframes."
View original CVE JSON
{
"id": "CVE-2025-65922",
"sourceIdentifier": "[email protected]",
"published": "2026-01-05T18:15:44.397",
"lastModified": "2026-11-04T22:10:00.210",
"vulnStatus": "Deferred",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead to unintended modification of projects or tasks, it exposes users to Phishing attacks. Attackers can frame the legitimate Planka application on a malicious site to establish false trust (UI Redressing), potentially tricking users into entering sensitive information or credentials into overlaid fake forms. NOTE: this is disputed by the Supplier because \"PLANKA uses SameSite=Strict cookies, preventing authentication in cross-origin contexts. No session can be established. No credential interception or unauthorized actions are possible. Browser Same-Origin Policy prevents the parent page from accessing iframe content. Clickjacking is not applicable on the login page. Any credential capture would require attacker-controlled input and user interaction equivalent to phishing. The security outcome depends entirely on the user's trust in the parent page. An attacker can achieve the same effect with a fully fake login page. Embedding the legitimate page adds no risk, as browsers do not show URL, certificate, or padlock indicators in cross-origin iframes.\""
},
{
"lang": "es",
"value": "PLANKA 2.0.0 carece de los encabezados X-Frame-Options y CSP frame-ancestors, lo que permite que la aplicación sea incrustada dentro de iframes maliciosos. Si bien esto no conduce a una modificación no intencionada de proyectos o tareas, expone a los usuarios a ataques de phishing. Los atacantes pueden enmarcar la aplicación legítima de Planka en un sitio malicioso para establecer una confianza falsa (Rediseño de interfaz de usuario), engañando potencialmente a los usuarios para que introduzcan información sensible o credenciales en formularios falsos superpuestos. NOTA: esto es refutado por el Proveedor porque ’PLANKA utiliza cookies SameSite=Strict, impidiendo la autenticación en contextos de origen cruzado. No se puede establecer ninguna sesión. No es posible la interceptación de credenciales ni acciones no autorizadas. La Política del Mismo Origen del navegador impide que la página padre acceda al contenido del iframe. El clickjacking no es aplicable en la página de inicio de sesión. Cualquier captura de credenciales requeriría una entrada controlada por el atacante y una interacción del usuario equivalente al phishing. El resultado de seguridad depende enteramente de la confianza del usuario en la página padre. Un atacante puede lograr el mismo efecto con una página de inicio de sesión completamente falsa. Incrustar la página legítima no añade ningún riesgo, ya que los navegadores no muestran indicadores de URL, certificado o candado en iframes de origen cruzado.’"
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"version": "n/a",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-01-05T21:33:15.883184Z",
"id": "CVE-2025-65922",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1021"
}
]
}
],
"references": [
{
"url": "https://github.com/09OHs/CVE/blob/e67290bef68d35980d10fd87c9c4403d8e40fc2c/CVE-2025-65922/CVE-2025-65922.pdf",
"source": "[email protected]"
},
{
"url": "https://github.com/plankanban/planka",
"source": "[email protected]"
}
]
}