high7.5
CVE-2023-47323
Missing access control in Silverpeas
Impact
The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.silverpeas.core:silverpeas-core-api | < 6.3.2 | 6.3.2 |
| maven | org.silverpeas.core:silverpeas-core-web | < 6.3.2 | 6.3.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Silverpeas | Silverpeas | before 6.3.2 |
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47323
- https://github.com/advisories/GHSA-cwh6-hm53-6w2m
- https://nvd.nist.gov/vuln/detail/CVE-2023-47323
- https://github.com/Silverpeas/Silverpeas-Core/commit/6383746372d408eeefa73e17ef95608ddd2c7fba
- http://silverpeas.com