The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSilverpeas
APPSilverpeas< 6.3.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2024-42850CRITICAL9.8PL ✓ten sam produkt
Silverpeas – pomijanie wymagań złożoności hasła przy jego zmianie
CVE-2024-36042CRITICAL9.8PL ✓ten sam produkt
Silverpeas – pominięcie hasła umożliwia dostęp jako superadmin (Auth Bypass)
CVE-2018-19586CRITICAL9.9ten sam produkt
Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be tr...
CVE-2024-48814HIGH7.5ten sam produkt
SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via t...
CVE-2023-47320HIGH8.1ten sam produkt
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to ex...