{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asilverpeassilverpeas/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:silverpeas:silverpeas:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.5,"id":"CVE-2024-42849"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Silverpeas (\u003c= 6.4.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Silverpeas"],"content_html":"\u003cp\u003eCVE-2024-42849 is a security vulnerability in Silverpeas version 6.4.2 and lower that allows a remote, authenticated attacker to trigger a denial-of-service (DoS) condition. The vulnerability resides within the application's password change functionality. By crafting a request that includes an excessively large string (approximately 1MB) as the new password, an attacker forces the application to perform resource-intensive hashing operations. These operations exhaust system CPU and memory resources, rendering the Silverpeas application unresponsive to legitimate user traffic. A proof-of-concept exploit for this vulnerability has been publicly released, increasing the risk of exploitation for organizations running unpatched versions of the platform.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker performs successful authentication to the Silverpeas web application.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to the user profile or password management interface to initiate a password change request.\u003c/li\u003e\n\u003cli\u003eThe attacker intercepts the HTTP POST request intended for the password change endpoint using a proxy tool such as Burp Suite.\u003c/li\u003e\n\u003cli\u003eThe attacker modifies the password parameters in the intercepted request, substituting the standard password with a 1MB string.\u003c/li\u003e\n\u003cli\u003eThe attacker forwards the modified HTTP request to the Silverpeas server.\u003c/li\u003e\n\u003cli\u003eThe Silverpeas server receives the request and attempts to process the password change, invoking its internal hashing algorithm on the 1MB payload.\u003c/li\u003e\n\u003cli\u003eThe system encounters extreme resource exhaustion as it attempts to hash the oversized string, leading to high CPU and memory utilization.\u003c/li\u003e\n\u003cli\u003eThe application service crashes or becomes unresponsive to all other users, resulting in a denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a complete denial of service for the Silverpeas application, preventing legitimate users from accessing or utilizing the platform. Given the availability of a public PoC, there is a moderate risk to any organization operating Silverpeas 6.4.2 or earlier, particularly in enterprise environments where service availability is critical.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Silverpeas to a version post-6.4.2 immediately to mitigate the underlying resource handling flaw.\u003c/li\u003e\n\u003cli\u003eImplement request size limits on the web server or application gateway level to reject incoming HTTP requests containing abnormally large payloads for password fields.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP POST requests with unusually large request bodies or request lengths targeting password change endpoints.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T19:22:58Z","date_published":"2026-10-19T19:22:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-silverpeas-dos/","summary":"CVE-2024-42849 is a remote denial-of-service vulnerability in Silverpeas 6.4.2 and lower, where an attacker can exhaust server resources by submitting an excessively large password string during a password change request.","title":"Denial of Service Vulnerability in Silverpeas","url":"https://feed.craftedsignal.io/briefs/2026-10-silverpeas-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:silverpeas:silverpeas:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}