CVE-2024-42850

The vulnerability concerns the implementation of the password change mechanism (CWE-521: Weak Password Requirements). Password complexity verification can be bypassed, meaning that server-side controls are not properly enforced. As a result, it is possible to set a password that does not meet minimum security requirements — such as very short or trivial passwords — without any blocking from the application.

An attacker can set a weak or trivial password for an account, making it easier to compromise later using methods such as dictionary attacks or brute-force. As a result, unauthorized access to the system and associated data is possible.

Apply patches available from the vendor according to the references. It is recommended to update to a version higher than 6.4.2. Until the patch is implemented, it is recommended to enforce a strong password policy at the organizational level and monitor password change attempts in application logs.

Silverpeas in version 6.4.2 and lower.