PT-2025-3348 · Unknown · Silverpeas Core

Mohamed Saqib C · Published 2025-01-22 · Updated 2025-01-23 · CVE-2024-56923

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverpeas Core versions 6.3.1 through 6.4.1

Description The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability in the Categorization Option of the My Subscriptions functionality. A remote attacker can execute arbitrary JavaScript code by injecting a malicious payload into the Name field of a subscription. This can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription.

Recommendations For Silverpeas Core versions 6.3.1 through 6.4.1, consider disabling the Categorization Option of the My Subscriptions functionality until a patch is available. Restrict access to the My Subscriptions feature to minimize the risk of exploitation. Avoid using the Name field in the affected subscription functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56923

GHSA-788M-27G4-CF86

Affected Products

Silverpeas Core

References · 10

• 🔥 https://github.com/Mohamed-Saqib-C/CVEs/blob/main/CVE-2024-56923/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-56923 · Security Note
• https://osv.dev/vulnerability/GHSA-788m-27g4-cf86 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-56923 · Vendor Advisory
• https://github.com/Silverpeas/Silverpeas-Core · Note
• https://github.com/Silverpeas/Silverpeas-Core/pull/1373 · Note
• https://t.me/cvedetector/16143 · Telegram Post
• https://twitter.com/CVEnew/status/1882300227404664956 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1882179053253263771 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1882179052993118326 · Twitter Post