silverpeas 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk csrf、vendor risk sql injection、パス処理の欠陥, and vendor risk input validation があり、vendor surface production workloads and vendor surface software deployment の利用場面で vendor impact unexpected behavior、ファイル上書き, and vendor impact data exposure などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2025-46047 | A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter. | [email protected] | 6.5 | 0.02% | 2025-09-02 | 2025-09-04 |
| CVE-2025-45055 | Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attackers to escalate privileges by creating a new administrator account. The vulnerability arises from insufficient sanitization of SVG files and weak CSRF protections. | [email protected] | 5.4 | 0.05% | 2025-06-09 | 2025-06-25 |
| CVE-2024-56923 | Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription. | [email protected] | 5.4 | 0.21% | 2025-01-22 | 2025-05-28 |
| CVE-2024-48814 | SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the findbywhereclause function | [email protected] | 7.5 | 0.07% | 2025-01-03 | 2025-05-28 |
| CVE-2024-42850 | An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. | [email protected] | 9.8 | 49.78% | 2024-08-16 | 2025-06-05 |
| CVE-2024-42849 | An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function. | [email protected] | 6.5 | 11.35% | 2024-08-16 | 2025-06-05 |
| CVE-2024-39031 | In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click o | [email protected] | 5.4 | 6.74% | 2024-07-09 | 2025-06-05 |
| CVE-2024-36042 | Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access. | [email protected] | 9.8 | 0.15% | 2024-06-03 | 2025-05-29 |
| CVE-2024-29392 | Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController. | [email protected] | 5.4 | 0.12% | 2024-05-22 | 2025-04-23 |
| CVE-2023-47327 | The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL. | [email protected] | 4.3 | 0.14% | 2023-12-13 | 2024-11-21 |
| CVE-2023-47326 | Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function. | [email protected] | 8.8 | 0.23% | 2023-12-13 | 2024-11-21 |
| CVE-2023-47325 | Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces. | [email protected] | 5.4 | 0.20% | 2023-12-13 | 2025-05-22 |
| CVE-2023-47324 | Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. | [email protected] | 5.4 | 0.28% | 2023-12-13 | 2024-11-21 |
| CVE-2023-47323 | The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators. | [email protected] | 7.5 | 0.81% | 2023-12-13 | 2024-11-21 |
| CVE-2023-47322 | The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application. | [email protected] | 8.8 | 0.11% | 2023-12-13 | 2024-11-21 |
| CVE-2023-47321 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. | [email protected] | 4.9 | 0.25% | 2023-12-13 | 2024-11-21 |
| CVE-2023-47320 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below. | [email protected] | 8.1 | 0.27% | 2023-12-13 | 2025-05-22 |
| CVE-2018-19586 | Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the underlying system with privileges of the user running the application. Especially, an attacker may leverage the vulnerability to write an executable JSP file in an exposed web directory to execute commands o | [email protected] | 9.9 | 3.16% | 2019-04-09 | 2024-11-21 |