CVE-2023-47320

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://silverpeas.com	Product
https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320	Exploit Third Party Advisory
http://silverpeas.com	Product
https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:silverpeas:silverpeas:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:30

Type	Values Removed	Values Added
References	~~() http://silverpeas.com - Product~~	() http://silverpeas.com - Product
References	~~() https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320 - Exploit, Third Party Advisory~~	() https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320 - Exploit, Third Party Advisory

15 Dec 2023, 20:51

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-13 14:15

Updated : 2024-11-21 08:30

NVD link : CVE-2023-47320

Mitre link : CVE-2023-47320

CVE.ORG link : CVE-2023-47320

JSON object : View

Products Affected

silverpeas

silverpeas

CWE

NVD-CWE-Other

{"id": "CVE-2023-47320", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2023-12-13T14:15:44.153", "references": [{"url": "http://silverpeas.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://silverpeas.com", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in \"Maintenance Mode\" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below."}, {"lang": "es", "value": "Silverpeas Core 6.3.1 es vulnerable a un control de acceso incorrecto. Un atacante con pocos privilegios puede ejecutar la funci\u00f3n exclusiva de administrador de poner la aplicaci\u00f3n en \"Modo de mantenimiento\" debido a un control de acceso roto. Esto hace que la aplicaci\u00f3n no est\u00e9 disponible para todos los usuarios. Esto afecta a Silverpeas Core 6.3.1 y versiones anteriores."}], "lastModified": "2024-11-21T08:30:09.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:silverpeas:silverpeas:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4C6E996-03CD-4BD3-A74F-A450CA1B0C0B", "versionEndExcluding": "6.3.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}