CVE Feed

    Dashboard / CVE / CVE-2024-42850

    CVE-2024-42850

    An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.

    Published:Aug 16, 2024
    Last Modified:Jun 5, 2025
    EPS:Aug 16, 2024
    EPSS Score:0.19551
    CVSS Score:9.8

    Affected Products

    Vendor
    Silverpeas
    Product
    Silverpeas

    Exploits

    https://github.com/njmbb8/CVE-2024-42850https://github.com/njmbb8/CVE-2024-42850

    Common Weakness Enumeration

    CWE-521 Weak Password Requirements

    Related CVEs

    CVE-2026-53698 (CVSS 6.5) — Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.…
    CVE-2026-30139 (CVSS 6.1) — A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core be…
    CVE-2025-46047 (CVSS 6.5) — A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.…
    CVE-2025-45055 (CVSS 5.4) — Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An…
    CVE-2024-56923 (CVSS 5.4) — Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality…
    CVE-2024-48814 (CVSS 7.5) — SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via t…
    CVE-2024-42849 (CVSS 6.5) — An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the passwor…
    CVE-2024-39031 (CVSS 5.4) — In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Addi…
    CVE-2024-36042 (CVSS 9.8) — Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, …
    CVE-2024-29392 (CVSS 5.4) — Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High