CVE-2023-47323: Missing access control in Silverpeas

December 13, 2023

The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.

References

github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47323
github.com/Silverpeas/Silverpeas-Core/commit/6383746372d408eeefa73e17ef95608ddd2c7fba
github.com/advisories/GHSA-cwh6-hm53-6w2m
nvd.nist.gov/vuln/detail/CVE-2023-47323

Code Behaviors & Features

Detect and mitigate CVE-2023-47323 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →