CVE-2023-47323: Missing access control in Silverpeas

December 13, 2023

The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.

References

github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47323
github.com/Silverpeas/Silverpeas-Core/commit/6383746372d408eeefa73e17ef95608ddd2c7fba
github.com/advisories/GHSA-cwh6-hm53-6w2m
nvd.nist.gov/vuln/detail/CVE-2023-47323

Code Behaviors & Features

Detect and mitigate CVE-2023-47323 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →