Silverpeas Core Reflected Cross-Site Scripting Vulnerability in AdvancedSearch Functionality

A reflected cross-site scripting vulnerability has been identified in the AdvancedSearch feature of Silverpeas Core, affecting versions prior to 6.4.6. This vulnerability allows attackers to execute arbitrary JavaScript in the context of the user's browser by injecting crafted input.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected JavaScript is executed in the user's browser.

Reproduction

To reproduce this vulnerability, inject a script payload, such as an image tag with an error event handler, into a vulnerable AdvancedSearch parameter. When the request is processed, the injected JavaScript will execute in the user's browser.

Remediation

Users can upgrade to Silverpeas Core version 6.4.6 or later to address this vulnerability.