PT-2023-30419 · Unknown · Silverpeas Core

Tyler Ramsbey · Published 2023-12-13 · Updated 2023-12-18 · CVE-2023-47326

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1

Description The issue is related to Cross Site Request Forgery (CSRF) via the Domain SQL Create function. This means that an attacker could potentially trick a user into performing unintended actions on the application.

Recommendations For Silverpeas Core version 6.3.1, consider disabling the Domain SQL Create function until a patch is available to prevent potential CSRF attacks. Restrict access to this function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-47326

GHSA-GQGV-7WPJ-VM6Q

Affected Products

Silverpeas Core

References · 10

• 🔥 https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47326 · Exploit
• https://osv.dev/vulnerability/GHSA-gqgv-7wpj-vm6q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47326 · Security Note
• https://github.com/Silverpeas/Silverpeas-Core · Note
• https://t.me/cvenotify/63461 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734961773822841291 · Twitter Post
• https://twitter.com/CVEnew/status/1734944423199514929 · Twitter Post
• https://t.me/cvenotify/63972 · Telegram Post
• http://silverpeas.com · Note