CVE-2024-39031: XSS
In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click on the event.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39031?
CVE-2024-39031 is categorized as a medium severity vulnerability due to potential XSS exploits.
How do I fix CVE-2024-39031?
To fix CVE-2024-39031, upgrade Silverpeas Core to version 6.4 or higher.
What platforms are affected by CVE-2024-39031?
CVE-2024-39031 affects Silverpeas Core versions up to 6.3.5, including its web and RS packages.
What type of attack does CVE-2024-39031 facilitate?
CVE-2024-39031 facilitates cross-site scripting (XSS) attacks through user input in calendar events.
Can administrators be affected by CVE-2024-39031?
Yes, since users can invite administrators to events, they may also be exposed to the XSS payload.