Several Security Vulnerabilities Found

[TheDarkMentor]

Hello Silverpeas team,

I am a security researcher and I have found a few different vulnerabilities within the application.

I noticed this tab is for "issues" and want to clarify whether it is only for minor bugs and possible fixes users find when using the application. Is it okay with the team to post security vulnerabilities found here?

I am happy to submit my findings to you the way your team feels comfortable with and will get them to you as soon I have the preferred method.

Thank you.

[mmoqui]

Hi, we usually prefer the vuln to be reported in our issue tracker referred in https://www.silverpeas.org/issue-management.html so that it should be easier both for us and the reporter to follow the their life-cycle.

For doing, please ask for an account by giving all the required and easily verifiable information about you (otherwise your ask will be rejected). Once your account enabled, you'll be part of the security project and you could report any of your discoveries.

[TheDarkMentor]

Sure thing. My name is Dr. Emmanuel DeJesus, I am a security researcher and my email is somementor2@gmail.com. As for my organization and organization URL I do not have those up to date on my linkedIn Currently. Posting here as the formal request so hopefully we can move forward.

I did not see a formal request area in this link https://www.silverpeas.org/issue-management.html.

[mmoqui]

The URL to access our issue tracker is in https://www.silverpeas.org/issue-management.html

[TheDarkMentor]

Ahh I should have been more clear. My fault. When I click the link you provided I can see this URL https://tracker.silverpeas.org/ to get to the issue tracker. Unfortunately, when I continue and click that link I get a forbidden page, with the following.

"Forbidden
You don't have permission to access this resource."

Provided a screen shot below in case this helps. Please advise.

[mmoqui]

Ha yes, indeed, Since a DDOS against our issue tracker, the sysadmin decided temporarily to authorize the access from only a very tiny set of countries. Give me the country from which you want to access the tracker to put it among the authorized countries

[TheDarkMentor]

Some people always have to ruin it for the rest of us. Blows my mind, can't even understand the point of it. Glad you guys found a work around though!

I am out of the USA.

[TheDarkMentor]

So I was able to get to the registry page but once there I cannot register because the captcha refuses to work, I have tried on two different pc's and 3 different browsers hoping for a different result.

Do you know of any fix for this issue?

Screenshot below in case you know of a fix: