Lucene search

GoogleOSV:CVE-2024-41804

HistoryJul 30, 2024 - 4:15 p.m.

CVE-2024-41804

2024-07-3016:15:04

Google

osv.dev

xibo

cms

sql injection

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

AI Score

7.6

Confidence

Low

EPSS

0.001

Percentile

27.3%

JSON

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the formula parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.

References

github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patch

github.com/xibosignage/xibo-cms/security/advisories/GHSA-4pp3-4mw7-qfwr

xibosignage.com/blog/security-advisory-2024-07

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

AI Score

7.6

Confidence

Low

EPSS

0.001

Percentile

27.3%

JSON

Related for OSV:CVE-2024-41804