CVE-2023-47322: 
Java vulnerability analysis and mitigation

The "userModify" feature of Silverpeas Core 6.3.1 contains a Cross Site Request Forgery (CSRF) vulnerability that can lead to privilege escalation. The vulnerability was discovered and assigned CVE-2023-47322, with disclosure occurring on December 13, 2023. The affected software is Silverpeas Core version 6.3.1 and earlier versions, with the issue being fixed in version 6.3.2 (NVD, Rhino Labs).

The vulnerability exists in the "userModify" request functionality of Silverpeas Core. It has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-352: Cross-Site Request Forgery (CSRF) (NVD).

If successfully exploited, this vulnerability allows an attacker to gain administrator privileges within the Silverpeas application. When an authenticated administrator visits a malicious URL, the CSRF attack can execute, resulting in the elevation of the attacker's privileges to administrator level (Rhino Labs).

The vulnerability requires user interaction, specifically requiring an authenticated administrator to visit a malicious URL while logged into the Silverpeas application. A proof-of-concept exploit has been publicly released, which involves hosting a specially crafted HTML file on an attacker-controlled web server (Rhino Labs).

The vulnerability has been fixed in Silverpeas Core version 6.3.2. Organizations using affected versions should upgrade to the patched version to mitigate this security risk (NVD).