CVE-2024-36042: Critical severity silverpeas core vulnerability
Published Jun 3, 2024
·Updated
Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.
Affected Software
2 affected componentsFixes available
maven/org.silverpeas.core:silverpeas-core<6.3.5
6.3.5
Silverpeas Silverpeas<6.3.5
Event History
Jan 1, 1970
CVE Published
via MITRE·12:00 AM
Jun 3, 2024
CVE Published
via NVD·06:15 AM
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 AM
Affected Software
Advisory Published
via GitHub·06:30 AM
Aug 2, 2024
Data Sourced
via MITRE·03:33 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2024-36042?
CVE-2024-36042 is considered a high severity vulnerability due to its potential to allow unauthorized superadmin access.
2
How do I fix CVE-2024-36042?
To fix CVE-2024-36042, upgrade your Silverpeas installation to version 6.3.5 or later.
3
What systems are affected by CVE-2024-36042?
CVE-2024-36042 affects all versions of Silverpeas prior to 6.3.5.
4
Can CVE-2024-36042 be exploited remotely?
Yes, CVE-2024-36042 can be exploited remotely if an unauthenticated user accesses the AuthenticationServlet.
5
What does CVE-2024-36042 allow an attacker to do?
CVE-2024-36042 allows an attacker to bypass authentication and gain superadmin access without valid credentials.