PT-2023-30413 · Unknown · Silverpeas Core

Tyler Ramsbey · Published 2023-12-13 · Updated 2023-12-15 · CVE-2023-47320

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Silverpeas Core versions 6.3.1 and below

Description The issue is related to Incorrect Access Control, allowing an attacker with low privileges to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users.

Recommendations For Silverpeas Core versions 6.3.1 and below, consider restricting access to the administrator-only functions until a patch is available. As a temporary workaround, disabling the ability to put the application in "Maintenance Mode" can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2023-47320

GHSA-WHGV-6J78-5RH2

Affected Products

Silverpeas Core

References · 11

• 🔥 https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320 · Exploit
• https://osv.dev/vulnerability/CVE-2023-47320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47320 · Security Note
• https://osv.dev/vulnerability/GHSA-whgv-6j78-5rh2 · Vendor Advisory
• https://github.com/Silverpeas/Silverpeas-Core · Note
• https://github.com/Silverpeas/Silverpeas-Core/commit/fcb4a9740b6c80859e435045b549290a82ae84a2 · Note
• https://t.me/cvenotify/63835 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734963292999684183 · Twitter Post
• https://twitter.com/CVEnew/status/1734944417235218499 · Twitter Post
• https://t.me/cvenotify/63455 · Telegram Post
• http://silverpeas.com · Note