CVE-2024-56923

Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription.

Published: Jan 22, 2025
Updated: Aug 11, 2025
CVE: CVE-2024-56923
GHSA: GHSA-788m-27g4-cf86
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
org.silverpeas.core / silverpeas-core	6.3.1	6.4.2
silverpeas / silverpeas	6.3.1	6.4.2

https://github.com/Mohamed-Saqib-C/CVEs/blob/main/CVE-2024-56923/README.md
https://github.com/Silverpeas/Silverpeas-Core/pull/1373

Vulnerability Database

CVE-2024-56923