CVE-2025-45055: XSS
Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attackers to escalate privileges by creating a new administrator account. The vulnerability arises from insufficient sanitization of SVG files and weak CSRF protections.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-45055?
CVE-2025-45055 is classified as a high severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2025-45055?
To fix CVE-2025-45055, update Silverpeas to a version that addresses this stored XSS vulnerability.
Who is affected by CVE-2025-45055?
CVE-2025-45055 affects users of Silverpeas version 6.4.2 who have access to the event management module.
What are the implications of CVE-2025-45055?
The implications of CVE-2025-45055 include the risk of malicious JavaScript being executed in the administrator's session, potentially leading to unauthorized actions.
Can an unauthorized user exploit CVE-2025-45055?
No, an unauthorized user cannot exploit CVE-2025-45055 as it requires authentication to upload the malicious SVG file.