GHSA-vpp3-hpcm-v944

Broken access control in Silverpeas

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-47327

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.silverpeas.core:silverpeas-core-web	< 6.3.2	6.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-47327 advisory
https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47327 web
https://github.com/Silverpeas/Silverpeas-Core package
http://silverpeas.com web