Skip to content

Vendor

org.silverpeas.core vulnerabilities

16 published CVES affecting org.silverpeas.core, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
16
Critical
2
High
4
Medium
10
Low
0
Unscored
0
CISA KEV
0
Atom feed of org.silverpeas.core alerts

Products

Latest org.silverpeas.core CVEs

Newest publication first

  4. CVE-2024-56923 Cross site scripting in Silverpeas Core

    Published
    MediumCVSS 5.4 EPSS 0.32% PoC

    Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of...

  6. CVE-2024-39031 Silverpeas Core Cross-site Scripting vulnerability

    Published
    MediumCVSS 5.4 EPSS 0.77% PoC

    In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Descrip...

  7. CVE-2024-36042 Silverpeas authentication bypass

    Published
    CriticalCVSS 9.8 EPSS 0.94%

    Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

  9. CVE-2023-47325 Broken access control in Silverpeas

    Published
    MediumCVSS 5.4 EPSS 0.41%

    Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces.

  12. CVE-2023-47327 Broken access control in Silverpeas

    Published
    MediumCVSS 4.3 EPSS 0.52%

    The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.

  13. CVE-2023-47322 Cross Site Request Forgery in Silverpeas

    Published
    HighCVSS 8.8 EPSS 0.39%

    The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an...

  14. CVE-2023-47323 Missing access control in Silverpeas

    Published
    HighCVSS 7.5 EPSS 0.77%

    The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.

  16. CVE-2023-47320 Broken access control in Silverpeas

    Published
    HighCVSS 8.1 EPSS 0.72%

    Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.