CVE-2024-56923: XSS
Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56923?
CVE-2024-56923 is classified as a stored cross-site scripting (XSS) vulnerability, which can have a significant impact on security.
How do I fix CVE-2024-56923?
To remediate CVE-2024-56923, upgrade Silverpeas Core to version 6.4.2 or later.
What causes CVE-2024-56923?
CVE-2024-56923 is caused by the ability to inject malicious JavaScript code through the Name field in the My Subscriptions functionality.
Who is affected by CVE-2024-56923?
CVE-2024-56923 affects all versions of Silverpeas Core from 6.3.1 up to and including 6.4.1.
What can an attacker do with CVE-2024-56923?
An attacker exploiting CVE-2024-56923 can execute arbitrary JavaScript code in the context of the user's browser.