CVE Feed

    Dashboard / CVE / CVE-2023-47322

    CVE-2023-47322

    The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application.

    Published:Dec 13, 2023
    Last Modified:Nov 21, 2024
    EPS:Dec 13, 2023
    EPSS Score:0.00144
    CVSS Score:8.8

    Affected Products

    Vendor
    Silverpeas
    Product
    Silverpeas

    Exploits

    https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47322https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47322

    Related CVEs

    CVE-2026-53698 (CVSS 6.5) — Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.…
    CVE-2026-30139 (CVSS 6.1) — A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core be…
    CVE-2025-46047 (CVSS 6.5) — A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.…
    CVE-2025-45055 (CVSS 5.4) — Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An…
    CVE-2024-56923 (CVSS 5.4) — Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality…
    CVE-2024-48814 (CVSS 7.5) — SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via t…
    CVE-2024-42850 (CVSS 9.8) — An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password c…
    CVE-2024-42849 (CVSS 6.5) — An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the passwor…
    CVE-2024-39031 (CVSS 5.4) — In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Addi…
    CVE-2024-36042 (CVSS 9.8) — Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High