CVE-2024-42850
Published: 16 August 2024
Summary
CVE-2024-42850 is a critical-severity Weak Password Requirements (CWE-521) vulnerability in Silverpeas Silverpeas. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked in the top 2.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-42850 affects the password change function in Silverpeas versions 6.4.2 and earlier. The flaw allows bypass of password complexity requirements and is classified under CWE-521, with a CVSS 3.1 base score of 9.8 reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
An unauthenticated attacker can exploit the issue remotely to set passwords that violate the application's intended complexity rules. This weakens account protections and can lead to full system compromise when combined with other attack paths.
The listed references include the Silverpeas project site and a public GitHub repository containing vulnerability details, but no advisory text or patch information is supplied. The associated EPSS score is currently 0.4978 at its observed peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2590
Vulnerability details
An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables authenticated users to bypass password complexity checks during password changes, facilitating account manipulation (T1098) by allowing the creation of weak passwords on existing accounts.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Configuration settings can define and enforce strong password requirements to avoid weak policies.
IA policy establishes password requirements, directly addressing weak password requirements.
Ensuring authenticators have sufficient strength of mechanism for intended use addresses weak password requirements.
Organization-wide password and authentication policies are applied uniformly, preventing weak local password requirements.
Facilitated training and awareness of current practices improves definition and enforcement of sufficiently strong password requirements.
Dedicated security resources support deployment of strong authentication systems and enforcement of robust password policies.
Vulnerability scans assess password policies and weak credential requirements against benchmarks.
User documentation on maintaining security includes password requirements, directly mitigating weak password policies.