PT-2024-28339 · Unknown · Silverpeas Core

Toneemarqus · Published 2024-07-08 · Updated 2024-07-25 · CVE-2024-39031

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverpeas Core versions <= 6.3.5

Description The issue allows a standard user to inject an XSS payload into the Titre and Description fields when creating an event in Mes Agendas. The user can then invite others, including administrators, to the event. When the invited user views their profile, the payload is executed, even without interacting with the event.

Recommendations For Silverpeas Core versions <= 6.3.5, update to a version greater than 6.3.5 to resolve the issue. As a temporary workaround, consider restricting access to the event creation feature in Mes Agendas to minimize the risk of exploitation. Avoid using the Titre and Description fields in the event creation process until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-39031

GHSA-VFWH-GVF6-MFF8

Affected Products

Silverpeas Core

References · 10

• 🔥 https://github.com/toneemarqus/CVE-2024-39031 · Exploit
• https://osv.dev/vulnerability/GHSA-vfwh-gvf6-mff8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39031 · Vendor Advisory
• https://github.com/Silverpeas/Silverpeas-Core/pull/1346 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-39031 · Security Note
• https://github.com/Silverpeas/Silverpeas-Core · Note
• https://github.com/Silverpeas/Silverpeas-Core/commit/a0289f8a6f8b6a9ebc399973093118ddb48b77d8 · Note
• https://twitter.com/VulmonFeeds/status/1810460837187895348 · Twitter Post
• https://twitter.com/CVEnew/status/1811428065395843247 · Twitter Post
• https://t.me/cvedetector/457 · Telegram Post