CVE-2024-56923: Cross site scripting in Silverpeas Core

January 22, 2025 (updated January 29, 2025)

Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription.

References

github.com/Mohamed-Saqib-C/CVEs/blob/main/CVE-2024-56923/README.md
github.com/Silverpeas/Silverpeas-Core
github.com/Silverpeas/Silverpeas-Core/pull/1373
github.com/advisories/GHSA-788m-27g4-cf86
nvd.nist.gov/vuln/detail/CVE-2024-56923

Code Behaviors & Features

Detect and mitigate CVE-2024-56923 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →