Silverpeas authentication bypass

CRITICO 9.8CVE-2024-36042 · GHSA-4w54-wwc9-x62c · Published 03/06/2024 · updated 17/06/2026

In breve

CVE-2024-36042 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda org.silverpeas.core:silverpeas-core, silverpeas (silverpeas).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.94%, superiore al 60.8% delle vulnerabilità.
Correzione: aggiornare a 6.3.5 o successiva.

Package	Affected versions	Patched versions
org.silverpeas.core:silverpeas-core Maven	`< 6.3.5`	`6.3.5`
silverpeas silverpeas	`< 6.3.5`	`6.3.5`

Description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

NVD description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

References

nvd.nist.gov/vuln/detail/CVE-2024-36042 · ADVISORY
Silverpeas/Silverpeas-Core commit 11fb5e2 · WEB
gist.github.com/ChrisPritchard/4b6d5c70d9329ef116266a6c238dcb2d · WEB
Silverpeas/Silverpeas-Core · PACKAGE
Silverpeas/Silverpeas-Core · WEB
silverpeas.org · WEB
silverpeas.org · Product

Altre vulnerabilità di org.silverpeas.core:silverpeas-core

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.silverpeas.core:silverpeas-core

Maven

< 6.3.5

6.3.5

silverpeas

< 6.3.5

6.3.5

Description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

NVD description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

Altre vulnerabilità di org.silverpeas.core:silverpeas-core

Vedi tutto →