Silverpeas authentication bypass

KRITISCH 9.8CVE-2024-36042 · GHSA-4w54-wwc9-x62c · Published 03/06/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-36042 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in org.silverpeas.core:silverpeas-core, silverpeas (silverpeas).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.94%, höher als bei 60.8% aller Schwachstellen.
Abhilfe: auf 6.3.5 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.silverpeas.core:silverpeas-core Maven	`< 6.3.5`	`6.3.5`
silverpeas silverpeas	`< 6.3.5`	`6.3.5`

Description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

NVD description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

References

nvd.nist.gov/vuln/detail/CVE-2024-36042 · ADVISORY
Silverpeas/Silverpeas-Core commit 11fb5e2 · WEB
gist.github.com/ChrisPritchard/4b6d5c70d9329ef116266a6c238dcb2d · WEB
Silverpeas/Silverpeas-Core · PACKAGE
Silverpeas/Silverpeas-Core · WEB
silverpeas.org · WEB
silverpeas.org · Product

Weitere Schwachstellen in org.silverpeas.core:silverpeas-core

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.silverpeas.core:silverpeas-core

Maven

< 6.3.5

6.3.5

silverpeas

< 6.3.5

6.3.5

Description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

NVD description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

Weitere Schwachstellen in org.silverpeas.core:silverpeas-core

Alle anzeigen →