silverpeas CVE Vulnerabilities & Metrics

Focus on silverpeas vulnerabilities and metrics.

Last updated: 07 Jun 2025, 22:25 UTC

About silverpeas Security Exposure

This page consolidates all known Common Vulnerabilities and Exposures (CVEs) associated with silverpeas. We track both calendar-based metrics (using fixed periods) and rolling metrics (using gliding windows) to give you a comprehensive view of security trends and risk evolution. Use these insights to assess risk and plan your patching strategy.

For a broader perspective on cybersecurity threats, explore the comprehensive list of CVEs by vendor and product. Stay updated on critical vulnerabilities affecting major software and hardware providers.

Global CVE Overview

Total silverpeas CVEs: 16
Earliest CVE date: 09 Apr 2019, 18:29 UTC
Latest CVE date: 22 Jan 2025, 21:15 UTC

Latest CVE reference: CVE-2024-56923

Rolling Stats

30-day Count (Rolling): 0
365-day Count (Rolling): 5

Calendar-based Variation

Calendar-based Variation compares a fixed calendar period (e.g., this month versus the same month last year), while Rolling Growth Rate uses a continuous window (e.g., last 30 days versus the previous 30 days) to capture trends independent of calendar boundaries.

Variations & Growth

Month Variation (Calendar): 0%
Year Variation (Calendar): -50.0%

Month Growth Rate (30-day Rolling): 0.0%
Year Growth Rate (365-day Rolling): -50.0%

Monthly CVE Trends (current vs previous Year)

Annual CVE Trends (Last 20 Years)

Critical silverpeas CVEs (CVSS ≥ 9) Over 20 Years

CVSS Stats

Average CVSS: 0.56

Max CVSS: 9.0

Critical CVEs (≥9): 1

CVSS Range vs. Count

Range Count
0.0-3.9 15
4.0-6.9 0
7.0-8.9 0
9.0-10.0 1

CVSS Distribution Chart

Top 5 Highest CVSS silverpeas CVEs

These are the five CVEs with the highest CVSS scores for silverpeas, sorted by severity first and recency.

All CVEs for silverpeas

CVE-2024-56923 silverpeas vulnerability CVSS: 0 22 Jan 2025, 21:15 UTC

Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription.

CVE-2024-48814 silverpeas vulnerability CVSS: 0 03 Jan 2025, 15:15 UTC

SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the findbywhereclause function

CVE-2024-42850 silverpeas vulnerability CVSS: 0 16 Aug 2024, 19:15 UTC

An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.

CVE-2024-42849 silverpeas vulnerability CVSS: 0 16 Aug 2024, 19:15 UTC

An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function.

CVE-2024-39031 silverpeas vulnerability CVSS: 0 09 Jul 2024, 21:15 UTC

In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click on the event.

CVE-2024-36042 silverpeas vulnerability CVSS: 0 03 Jun 2024, 06:15 UTC

Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.

CVE-2024-29392 silverpeas vulnerability CVSS: 0 22 May 2024, 16:15 UTC

Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.

CVE-2023-47327 silverpeas vulnerability CVSS: 0 13 Dec 2023, 14:15 UTC

The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.

CVE-2023-47326 silverpeas vulnerability CVSS: 0 13 Dec 2023, 14:15 UTC

Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function.

CVE-2023-47325 silverpeas vulnerability CVSS: 0 13 Dec 2023, 14:15 UTC

Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces.

CVE-2023-47324 silverpeas vulnerability CVSS: 0 13 Dec 2023, 14:15 UTC

Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature.

CVE-2023-47323 silverpeas vulnerability CVSS: 0 13 Dec 2023, 14:15 UTC

The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.

CVE-2023-47322 silverpeas vulnerability CVSS: 0 13 Dec 2023, 14:15 UTC

The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application.

CVE-2023-47321 silverpeas vulnerability CVSS: 0 13 Dec 2023, 14:15 UTC

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets.

CVE-2023-47320 silverpeas vulnerability CVSS: 0 13 Dec 2023, 14:15 UTC

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below.

CVE-2018-19586 silverpeas vulnerability CVSS: 9.0 09 Apr 2019, 18:29 UTC

Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the underlying system with privileges of the user running the application. Especially, an attacker may leverage the vulnerability to write an executable JSP file in an exposed web directory to execute commands on the underlying system.