GHSA-g27c-w2v7-88xp

Cross Site Request Forgery in Silverpeas

Source: GitHub Advisory Database (reviewed) High CVE-2023-47322

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.silverpeas.core:silverpeas-core-web	< 6.3.2	6.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-47322 advisory
https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47322 web
https://github.com/Silverpeas/Silverpeas-Core package
http://silverpeas.com web