Cross-Site Scripting Vulnerability in Xibo CMS from Xibo Signage
CVE-2024-43412

5.4MEDIUM

Key Information:

Vendor

Xibosignage

Status
Xibo
Vendor
CVE Published:
3 September 2024

What is CVE-2024-43412?

Xibo, the open-source digital signage platform, harbors a security flaw in the CMS that permits authorized users to inject and execute arbitrary JavaScript through the file preview functionality. This vulnerability arises when users upload HTML, CSS, or JS files to the Xibo Library, which can then be referenced in Displays and Layouts. While this is part of the intended functionality, the execution of these files in the browser during the preview stage poses significant security risks. Xibo plans to eliminate this behavior in version 4.1.0, while urging users to utilize the updated developer tools introduced in this release for safer widget designs. No workarounds are currently available.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/xibosignage/xibo-cms/security/advisori...
https://github.com/xibosignage/xibo-cms/commit/d8f1333946...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.