PT-2023-24198 · Xibo · Xibo

Noam Moshe · Published 2023-05-30 · Updated 2023-06-06 · CVE-2023-33181

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xibo versions 3.0.0 through 3.3.4

Description Xibo is a content management system (CMS) that has an issue where some API routes print a stack trace when called with missing or invalid parameters, revealing sensitive information about the server's path locations.

Recommendations For versions 3.0.0 through 3.3.4, upgrade to version 3.3.5 to fix the issue. As a temporary workaround, consider restricting access to the affected API routes until the issue is resolved by upgrading to version 3.3.5.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2023-33181

GHSA-C9CX-GHWR-X58M

Affected Products

Xibo

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33181.json · Exploit
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33181 · Security Note
• https://xibosignage.com/blog/security-advisory-2023-05 · Vendor Advisory
• https://t.me/cvenotify/51828 · Telegram Post
• https://t.me/cvenotify/51421 · Telegram Post
• https://claroty.com/team82/disclosure-dashboard · Note