GHSA-4w54-wwc9-x62c

Silverpeas authentication bypass

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-36042

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.silverpeas.core:silverpeas-core	< 6.3.5	6.3.5

Details

As written in the advisory (Markdown source, shown as plain text).

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-36042 advisory
https://github.com/Silverpeas/Silverpeas-Core/commit/11fb5e21c252ce4751b85fccf5b8076156e0b4f0 web
https://gist.github.com/ChrisPritchard/4b6d5c70d9329ef116266a6c238dcb2d web
https://github.com/Silverpeas/Silverpeas-Core package
https://github.com/Silverpeas/Silverpeas-Core/tags web
https://silverpeas.org web