Security readout for executives and security teams
Plain-English summary
Silverpeas Core 6.3.1 is reported vulnerable to CSRF in the Domain SQL Create function. A victim with suitable privileges could be tricked into causing an unintended domain-related action. The source bundle does not provide CVSS, CWE, patch, or confirmed exploitation details.
Executive priority
Treat this as a verification priority, not an emergency, unless Silverpeas Core 6.3.1 is internet-accessible or widely administered by privileged users.
Technical view
CVE-2023-47326 describes a CSRF issue affecting Silverpeas Core 6.3.1 through the Domain SQL Create function. Structured affected-product metadata is incomplete, but the description names Silverpeas Core 6.3.1. No CVSS vector, fixed version, mitigation, or exploit-in-the-wild evidence is provided.
Likely exposure
Exposure is most likely where Silverpeas Core 6.3.1 is deployed and authenticated users can access domain administration functions through a browser.
Exploitation context
The bundle does not show CISA KEV listing or other active exploitation evidence. Public reference exists from Rhino Security Labs, but the provided data does not establish exploitation in the wild.
Researcher notes
Evidence is sparse: no CVSS, CWE, CPE, patch status, or KEV entry is included. The description and Rhino Security Labs reference support the CSRF classification and affected version, but operational impact requires local validation.
Mitigation direction
- Check Silverpeas vendor guidance for fixed versions or official mitigations.
- Inventory and prioritize any Silverpeas Core 6.3.1 deployments.
- Restrict domain administration access to trusted administrators only.
- Review browser-side and server-side CSRF protections for administrative actions.
- Monitor for unexpected Domain SQL Create or domain administration activity.
Validation and detection
- Confirm whether Silverpeas Core 6.3.1 is deployed in your environment.
- Identify who can access domain administration functions.
- Review change logs for unexpected domain creation activity.
- Check vendor advisories for a fixed version or configuration guidance.
- Verify CSRF defenses exist on sensitive administrative requests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-47326 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47326CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.