Package · Maven

org.silverpeas.core:silverpeas-core-api

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

Medium 5.4

CVE-2023-47324

Cross-site Scripting in silverpeas

Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature.

org.silverpeas.core:silverpeas-core-web org.silverpeas.core:silverpeas-core-war org.silverpeas.core:silverpeas-core-api org.silverpeas.core:silverpeas-core-configuration Maven

Dec 13, 2023
High 7.5

CVE-2023-47323

Missing access control in Silverpeas

The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.

org.silverpeas.core:silverpeas-core-web org.silverpeas.core:silverpeas-core-api Maven

Dec 13, 2023