CVE-2023-33177

🗓️ 30 May 2023 19:12:01Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

Xibo CMS path traversal vulnerability allows remote code execution

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for Path Traversal in Xibosignage Xibo	9 Apr 202617:10	–	githubexploit
Circl	CVE-2023-33177	17 Nov 202515:00	–	circl
CNNVD	Xibo 路径遍历漏洞	30 May 202300:00	–	cnnvd
Cvelist	CVE-2023-33177 Xibo CMS vulnerable to Remote Code Execution through Zip Slip	30 May 202319:12	–	cvelist
Exploit DB	xibocms 3.3.4 - RCE	8 Apr 202600:00	–	exploitdb
EUVD	EUVD-2023-37360	3 Oct 202520:07	–	euvd
NVD	CVE-2023-33177	30 May 202320:15	–	nvd
OSV	CVE-2023-33177 Xibo CMS vulnerable to Remote Code Execution through Zip Slip	30 May 202319:12	–	osv
Packet Storm	📄 XiboCMS 3.3.4 Traversal / Code Execution	10 Apr 202600:00	–	packetstorm
Prion	Path traversal	30 May 202320:15	–	prion

NVD

Vulners

Node

xibosignage xiboRange1.8.0–2.3.17

xibosignage xiboRange3.0.0–3.3.5

[
  {
    "vendor": "xibosignage",
    "product": "xibo-cms",
    "versions": [
      {
        "version": ">= 1.8.0, < 2.3.17",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.3.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/xibosignage/xibo-cms/commit/45c6b53c3978639db03b63270a56f4397f49b2c9
github	www.github.com/xibosignage/xibo-cms/commit/1cbba380fa751a00756e70d7b08b5c6646092658
github	www.github.com/xibosignage/xibo-cms/security/advisories/GHSA-jj27-x85q-crqv
claroty	www.claroty.com/team82/disclosure-dashboard
xibosignage	www.xibosignage.com/blog/security-advisory-2023-05/

Parameter	Position	Path	Description	CWE
cmd	query param	shell.php	Zip Slip path traversal leading to remote code execution via uploaded webshell in web root	CWE-22

21 Nov 2024 08:05Current

9.1High risk

Vulners AI Score9.1

CVSS 3.18.8

EPSS0.06752

SSVC

CWE-22