The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSilverpeas
APPSilverpeas< 6.3.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2024-42850CRITICAL9.8PL ✓same product
Silverpeas – pomijanie wymagań złożoności hasła przy jego zmianie
CVE-2024-36042CRITICAL9.8PL ✓same product
Silverpeas – pominięcie hasła umożliwia dostęp jako superadmin (Auth Bypass)
CVE-2018-19586CRITICAL9.9PL ✓same product
Path Traversal podczas uploadu plików w Silverpeas 5.15–6.0.2
CVE-2024-48814HIGH7.5same product
SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via t...
CVE-2023-47320HIGH8.1same product
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to ex...