N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-46047

CVE-2025-46047: Silverpeas Core Username Enumeration Vulnerability

A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-46047

CVE-2025-46047:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.silverpeas.core:silverpeas-core	maven	>= 6.4.1, < 6.4.3	6.4.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis of CVE-2025-46047 in Silverpeas Core reveals a classic username enumeration issue located in the password management functionality accessible from the login page. The root cause is an observable discrepancy in the application's HTTP response based on whether a provided username exists in the system.

Two primary functions were identified as vulnerable:

org.silverpeas.core.web.authentication.credentials.ForgotPasswordHandler.doAction: This function, which handles the password reset process, would return a different navigation path for invalid usernames versus valid ones. The security patch corrects this by ensuring the code flow and the resulting response page are identical, regardless of the username's validity. This prevents an attacker from inferring the existence of a user account.
org.silverpeas.core.web.authentication.credentials.ChangePasswordFromLoginHandler.doAction: This function was part of a separate feature allowing users to change their password directly from the login page. It suffered from the same flaw, providing a different response for invalid users. The developers chose to mitigate this by completely removing the feature, as evidenced by the deletion of the ChangePasswordFromLoginHandler.java file.

During an exploit attempt, a profiler would trace the execution path through the CredentialsServlet, which dispatches the request to the appropriate handler. For the 'Forgot Password' endpoint, the ForgotPasswordHandler.doAction method would appear in the stack trace. An attacker would repeatedly call this endpoint with a list of potential usernames and analyze the responses to build a list of valid accounts. The identified functions are the exact locations where the vulnerable logic resided.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.