Silverpeas authentication bypass

CRÍTICO 9.8CVE-2024-36042 · GHSA-4w54-wwc9-x62c · Published 03/06/2024 · updated 17/06/2026

En resumen

CVE-2024-36042 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a org.silverpeas.core:silverpeas-core, silverpeas (silverpeas).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.94%, mayor que el 60.8% de las vulnerabilidades.
Solución: actualizar a 6.3.5 o posterior.

Package	Affected versions	Patched versions
org.silverpeas.core:silverpeas-core Maven	`< 6.3.5`	`6.3.5`
silverpeas silverpeas	`< 6.3.5`	`6.3.5`

Description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

NVD description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

References

nvd.nist.gov/vuln/detail/CVE-2024-36042 · ADVISORY
Silverpeas/Silverpeas-Core commit 11fb5e2 · WEB
gist.github.com/ChrisPritchard/4b6d5c70d9329ef116266a6c238dcb2d · WEB
Silverpeas/Silverpeas-Core · PACKAGE
Silverpeas/Silverpeas-Core · WEB
silverpeas.org · WEB
silverpeas.org · Product

Más vulnerabilidades de org.silverpeas.core:silverpeas-core

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.silverpeas.core:silverpeas-core

Maven

< 6.3.5

6.3.5

silverpeas

< 6.3.5

6.3.5

Description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

NVD description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

Más vulnerabilidades de org.silverpeas.core:silverpeas-core

Ver todo →