Cross-Site Scripting in Xibo CMS Affects Digital Signage Solutions
CVE-2024-43413

4.8MEDIUM

Key Information:

Vendor

Xibosignage

Status
Xibo
Vendor
CVE Published:
3 September 2024

What is CVE-2024-43413?

Xibo CMS, an open-source digital signage platform, is affected by a cross-site scripting vulnerability that enables authorized users to execute malicious JavaScript through the DataSet functionality. Prior to version 4.1.0, users could create DataSets with HTML columns containing JavaScript. This JavaScript would then execute on the Data Entry page and any Layouts referencing it. The vulnerability has been addressed in version 4.1.0, which alters the behavior to display HTML, CSS, and JavaScript as code on the Data Entry page, eliminating the risk of execution. There are currently no workarounds available for this vulnerability.

References

https://github.com/xibosignage/xibo-cms/security/advisori...
https://github.com/xibosignage/xibo-cms/commit/009527855d...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.