CVE-2024-39031: Silverpeas-Core · Cross-site Scripting
Affects Silverpeas-CoreSource CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 9 Jul 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubsilverpeas/Silverpeas-Corepkg:github/silverpeas/Silverpeas-CoreOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2024-39031, organizations should first check for any official patches or updates from Silverpeas and apply them promptly once available. In the absence of patches, implement strict input validation and output encoding on the "Titre" and "Description" fields to neutralize any injected scripts. Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in the application context. Limit the ability of standard users to invite administrators to events or implement additional verification steps before invitations are accepted. Monitor user activity logs for unusual event creation or invitation patterns. Educate users, especially administrators, to be cautious when viewing profile pages and consider temporarily restricting profile page access or disabling event invitations until the vulnerability is remediated. Conduct regular security assessments and penetration testing focused on XSS vulnerabilities. Finally, consider deploying Web Application Firewalls (WAFs) with rules to detect and block XSS payloads targeting Silverpeas.
Description
In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click on the event.