CVE-2024-39031
Published: 09 July 2024
Summary
CVE-2024-39031 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Silverpeas Silverpeas. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked in the top 8.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-39031 is a stored cross-site scripting vulnerability (CWE-79) affecting Silverpeas Core versions up to and including 6.3.5. It resides in the Mes Agendas calendar component, where event title and description fields lack proper output encoding when events are later rendered on user profile pages.
A low-privileged user can create a calendar event containing an XSS payload in the Titre or Description fields and invite any other user in the same domain, including administrators. When the invited victim subsequently views their own profile page, the payload executes in their browser context without any further interaction with the event itself, enabling theft of session tokens or other client-side actions.
A pull request addressing the issue has been published in the Silverpeas-Core repository. The EPSS score has remained flat at 0.0674 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2421
Vulnerability details
In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an…
more
XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click on the event.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS allows arbitrary JavaScript execution in any invited user's (including admin) browser context when viewing profile, calendar, or related pages, enabling JavaScript command execution, browser session hijacking, web session cookie theft, and credentials theft from web browsers to achieve privilege escalation.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.