-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key flaws: 1) AuthenticationService's checkAuthentication method used isPasswordSet() to select between authentication methods, allowing passwordless requests to use domain-only authentication. 2) AuthenticationServlet's request handling failed to enforce remote authentication flags for passwordless flows. The patch added explicit remote authentication tracking (authenticated flag) and reversed the authentication path selection logic to require explicit proof of external authentication when bypassing password checks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.silverpeas.core:silverpeas-core | maven | < 6.3.5 | 6.3.5 |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report