CVE-2023-47327
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The 'Create a Space' feature in Silverpeas Core 6.3.1 is reserved for administrators but suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.
Risk Assessment
The risk is that unauthorized users can create spaces, potentially leading to uncontrolled organizational structure growth, data leakage, or abuse.
Recommendation
It is recommended to immediately update Silverpeas Core to the latest version and implement access control fixes so that the 'Create a Space' feature is restricted to administrators only.
Other vulnerabilities in Silverpeas Core
See all- CVE-2026-78742Medium
Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction.
- CVE-2026-78741Medium
Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image upload feature.
- CVE-2026-78738Medium
Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management file upload feature.
- CVE-2023-47326High
Silverpeas Core 6.3.1 is vulnerable to Cross-Site Request Forgery (CSRF) via the Domain SQL Create function. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
- CVE-2023-47325Medium
A vulnerability in Silverpeas Core 6.3.1 administrative 'Bin' feature allows a low-privileged user to access the bin, revealing all deleted spaces. The user can then restore or permanently delete these spaces.
- CVE-2023-47324Medium
Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. An attacker can inject malicious JavaScript code into message content.
- CVE-2023-47323High
The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.
- CVE-2023-47322High
The 'userModify' feature in Silverpeas Core 6.3.1 is vulnerable to Cross-Site Request Forgery (CSRF) leading to privilege escalation. If an administrator visits a malicious URL while authenticated, the attacker can become an administrator user.
- CVE-2023-47321Medium
Silverpeas Core 6.3.1 has an incorrect access control vulnerability in the 'Porlet Deployer' component, allowing administrators to deploy .WAR portlets. This could lead to unauthorized code execution or privilege escalation.
- CVE-2023-47320High
Silverpeas Core 6.3.1 and below contain an incorrect access control vulnerability. An attacker with low privileges can execute the administrator-only function of enabling maintenance mode, making the application unavailable to all users.
Original NVD description (English source)
The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS