CVE-2023-47323
The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.
- Affected products
- Silverpeas Core
- Silverpeas
- < 6.3.2
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 0.8% (52th percentile)
- NVD status
- Modified
- Published
- 2023-12-13
CVE-2023-47323 at NVD
1 known exploit for CVE-2023-47323
Proof-of-concept code and exploit modules indexed by Sploitus