Silverpeas authentication bypass

CRÍTICO 9.8CVE-2024-36042 · GHSA-4w54-wwc9-x62c · Published 03/06/2024 · updated 17/06/2026

Em resumo

CVE-2024-36042 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta org.silverpeas.core:silverpeas-core, silverpeas (silverpeas).
Chance de exploração nos próximos 30 dias (EPSS): 0.94%, maior que 60.8% das vulnerabilidades.
Correção: atualize para 6.3.5 ou posterior.

Package	Affected versions	Patched versions
org.silverpeas.core:silverpeas-core Maven	`< 6.3.5`	`6.3.5`
silverpeas silverpeas	`< 6.3.5`	`6.3.5`

Description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

NVD description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

References

nvd.nist.gov/vuln/detail/CVE-2024-36042 · ADVISORY
Silverpeas/Silverpeas-Core commit 11fb5e2 · WEB
gist.github.com/ChrisPritchard/4b6d5c70d9329ef116266a6c238dcb2d · WEB
Silverpeas/Silverpeas-Core · PACKAGE
Silverpeas/Silverpeas-Core · WEB
silverpeas.org · WEB
silverpeas.org · Product

Mais vulnerabilidades de org.silverpeas.core:silverpeas-core

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.silverpeas.core:silverpeas-core

Maven

< 6.3.5

6.3.5

silverpeas

< 6.3.5

6.3.5

Description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

NVD description

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

Mais vulnerabilidades de org.silverpeas.core:silverpeas-core

Ver tudo →