CVE Feed

    Dashboard / CVE / CVE-2023-47325

    CVE-2023-47325

    Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces.

    Published:Dec 13, 2023
    Last Modified:May 22, 2025
    EPS:Dec 13, 2023
    EPSS Score:0.00198
    CVSS Score:5.4

    Affected Products

    Vendor
    Silverpeas
    Product
    Silverpeas

    Exploits

    https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47325https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47325

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-53698 (CVSS 6.5) — Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.…
    CVE-2026-30139 (CVSS 6.1) — A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core be…
    CVE-2025-46047 (CVSS 6.5) — A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.…
    CVE-2025-45055 (CVSS 5.4) — Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An…
    CVE-2024-56923 (CVSS 5.4) — Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality…
    CVE-2024-48814 (CVSS 7.5) — SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via t…
    CVE-2024-42850 (CVSS 9.8) — An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password c…
    CVE-2024-42849 (CVSS 6.5) — An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the passwor…
    CVE-2024-39031 (CVSS 5.4) — In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Addi…
    CVE-2024-36042 (CVSS 9.8) — Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High