CVE-2023-47324

Description

Silverpeas Core 6.3.1 and prior are vulnerable to Cross Site Scripting (XSS) via the message/notification feature.

How to fix CVE-2023-47324

To remediate CVE-2023-47324, upgrade the affected package to a fixed version below.

• Maven/org.silverpeas.core:silverpeas-core-api—upgrade to 6.3.2 or later
• Maven/org.silverpeas.core:silverpeas-core-configuration—upgrade to 6.3.2 or later
• —upgrade to 6.3.2 or later
• —upgrade to 6.3.2 or later

Is CVE-2023-47324 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 6.3.2
• from 0, < 6.3.2
• from 0, < 6.3.2
• from 0, < 6.3.2

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-47324
• WEBgithub.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47324
• WEBgithub.com/Silverpeas/Silverpeas-Core/commit/9cb2941e9242db3df179c1170d7695c9917e4e9c
• WEBgithub.com/Silverpeas/Silverpeas-Core/pull/1298/commits