Lucene search

GitHub_MCVELIST:CVE-2023-33181

HistoryMay 30, 2023 - 8:57 p.m.

CVE-2023-33181 Sensitive Information Disclosure abusing Stack Trace in Xibo CMS

2023-05-3020:57:38

CWE-209

GitHub_M

www.cve.org

cve-2023-33181

sensitive information disclosure

stack trace

xibo cms

api routes

upgrade

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

47.3%

JSON

Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.

CNA Affected

[
  {
    "vendor": "xibosignage",
    "product": "xibo-cms",
    "versions": [
      {
        "version": ">= 3.0.0, < 3.3.5",
        "status": "affected"
      }
    ]
  }
]

References

claroty.com/team82/disclosure-dashboard

github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m

xibosignage.com/blog/security-advisory-2023-05/

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

47.3%

JSON

Related for CVELIST:CVE-2023-33181