CVE-2023-33180
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.6 Medium
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
62.1%
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the /display/map API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the bounds parameter. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| xibosignage | xibo | * | cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:* |
CNA Affected
[
{
"vendor": "xibosignage",
"product": "xibo-cms",
"versions": [
{
"version": ">= 3.2.0, < 3.3.5",
"status": "affected"
}
]
}
]Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.6 Medium
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
62.1%