PatchTheCVECVE-2024-39031: In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar
CVE-2024-39031 is a medium-severity flaw (CVSS 5.4) affecting silverpeas. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be e
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.8% (top 45%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2024-07-09 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-39031?
silverpeas: upgrade to 6.4. Exact commands for each OS are on this page.
Is CVE-2024-39031 being exploited?
CVE-2024-39031 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-39031 affect?
CVE-2024-39031 affects silverpeas. Severity is medium (CVSS 5.4). In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an X
How urgent is CVE-2024-39031?
Priority 38/100. Public exploit reference
Related CVEs
- CVE-2024-42850 CRITICAL 9.8 UPGRADE An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password c
- CVE-2024-42849 MEDIUM 6.5 UPGRADE An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the passwor
- CVE-2025-45055 MEDIUM 5.4 DOWNGRADE Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module
- CVE-2024-56923 MEDIUM 5.4 UPGRADE Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality
- CVE-2024-48814 HIGH 7.5 DOWNGRADE SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via t