Description
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the APIs for importing JSON and importing a Layout containing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue
References (3)
Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-x4qm-vvhp-g7c2
Patch, Vendor Advisory x_refsource_misc
https://github.com/xibosignage/xibo-cms/commit/b7a5899338cd841a39702e3fcaff76aa0ffe4075
Vendor Advisory x_refsource_misc
https://xibosignage.com/blog/security-advisory-2024-07
Scores
CVSS v3
8.1
EPSS
0.0068
EPSS Percentile
71.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (1)
xibosignage/xibo
2.1.0 - 3.3.12
Published
Jul 30, 2024
Tracked Since
Feb 18, 2026