PT-2023-30419 · Unknown · Silverpeas Core

Tyler Ramsbey · Publicado 2023-12-13 · Atualizado 2023-12-18 · CVE-2023-47326

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1

Description The issue is related to Cross Site Request Forgery (CSRF) via the Domain SQL Create function. This means that an attacker could potentially trick a user into performing unintended actions on the application.

Recommendations For Silverpeas Core version 6.3.1, consider disabling the Domain SQL Create function until a patch is available to prevent potential CSRF attacks. Restrict access to this function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-47326

GHSA-GQGV-7WPJ-VM6Q

Produtos afetados

Silverpeas Core

Referências · 10

• 🔥 https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47326 · Exploit
• https://github.com/Silverpeas/Silverpeas-Core · Nota
• https://osv.dev/vulnerability/GHSA-gqgv-7wpj-vm6q · Aviso do Fabricante
• https://t.me/cvenotify/63461 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-47326 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1734961773822841291 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1734944423199514929 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-47326 · Nota de Segurança
• https://t.me/cvenotify/63972 · Publicação no Telegram
• http://silverpeas.com · Nota