org.silverpeas.core:silverpeas-core-web

3 results · Clear filters · Feed

• High 8.8
  CVE-2023-47322

  Cross Site Request Forgery in Silverpeas

  The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute ma…

  org.silverpeas.core:silverpeas-core-web Maven
  Dec 13, 2023
• High 7.5
  CVE-2023-47323

  Missing access control in Silverpeas

  The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.

  org.silverpeas.core:silverpeas-core-web org.silverpeas.core:silverpeas-core-api Maven
  Dec 13, 2023
• High 8.1
  CVE-2023-47320

  Broken access control in Silverpeas

  Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unava…

  org.silverpeas.core:silverpeas-core-web org.silverpeas.core:silverpeas-core-war Maven
  Dec 13, 2023