CVE-2023-47320 Broken access control in Silverpeas

What is CVE-2023-47320?

CVE-2023-47320 is a high-severity missing authorization vulnerability in n/a, published on 13 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below.

Weakness: CWE-863

Which versions are affected by CVE-2023-47320?

4 open source packages ship an affected version, including org.silverpeas.core:silverpeas-core-war and org.silverpeas.core:silverpeas-core-web. It affects 1 product.

Products include Silverpeas Silverpeas.

How do I fix CVE-2023-47320?

Upgrade org.silverpeas.core:silverpeas-core-war to 6.3.2 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-47320 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47320 exists.

Other vulnerabilities in n/a

• CVE-2018-19586 Path traversal in n/a Critical 9.9
• CVE-2024-42850 Silverpeas vulnerable to password complexity rule bypass Critical 9.8
• CVE-2024-36042 Silverpeas authentication bypass Critical 9.8
• CVE-2023-47322 Cross Site Request Forgery in Silverpeas High 8.8
• CVE-2023-47326 Cross Site Request Forgery in Silverpeas High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-whgv-6j78-5rh2.