Cross Site Request Forgery in Silverpeas
Date: 2023-12
Affected: maven/org.silverpeas.core:silverpeas-core-web
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-47322
CWE: CWE-352
CWE-79
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application.


Mitigations:

Architectural layers (MAESTRO):