PT-2023-30413 · Unknown · Silverpeas Core

Tyler Ramsbey · Publicado 2023-12-13 · Atualizado 2023-12-15 · CVE-2023-47320

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Silverpeas Core versions 6.3.1 and below

Description The issue is related to Incorrect Access Control, allowing an attacker with low privileges to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users.

Recommendations For Silverpeas Core versions 6.3.1 and below, consider restricting access to the administrator-only functions until a patch is available. As a temporary workaround, disabling the ability to put the application in "Maintenance Mode" can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Incorrect Authorization

Improper Access Control

Enumeração de Fraquezas

CWE-863

CWE-284

Identificadores relacionados

CVE-2023-47320

GHSA-WHGV-6J78-5RH2

Produtos afetados

Silverpeas Core

Referências · 11

• 🔥 https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320 · Exploit
• https://github.com/Silverpeas/Silverpeas-Core · Nota
• https://github.com/Silverpeas/Silverpeas-Core/commit/fcb4a9740b6c80859e435045b549290a82ae84a2 · Nota
• https://t.me/cvenotify/63835 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1734963292999684183 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1734944417235218499 · Publicação no Twitter
• https://t.me/cvenotify/63455 · Publicação no Telegram
• http://silverpeas.com · Nota
• https://osv.dev/vulnerability/CVE-2023-47320 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-47320 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-whgv-6j78-5rh2 · Aviso do Fabricante