PT-2024-22677 · Xibo · Xibo

Saadet-T · Published 2024-04-12 · Updated 2024-04-15 · CVE-2024-29023

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xibo versions prior to 3.3.10 Xibo versions prior to 4.0.9 Xibo version 1.8 Xibo version 2.3

Description Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently, they can be exfiltrated and used to hijack a session. Users must be granted access to the session page, or be a super admin.

Recommendations For Xibo versions prior to 3.3.10, upgrade to version 3.3.10. For Xibo versions prior to 4.0.9, upgrade to version 4.0.9. For Xibo version 1.8, apply the patch a81044e6ccdd92cc967e34c125bd8162432e51bc.diff. For Xibo version 2.3, apply the patch ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff. As a temporary workaround, consider restricting access to the sessions page to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-29023

GHSA-XMC6-CFQ5-HG39

Affected Products

Xibo

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29023.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-29023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29023 · Security Note
• https://github.com/xibosignage/xibo-cms/commit/3b93636aa7aea07d1f7dfa36b63b773ac16d7cde · Note
• https://github.com/xibosignage/xibo-cms/commit/49f018fd9fe64fcd417d7c2ef96078bd7b2b88b7 · Note
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-xmc6-cfq5-hg39 · Note
• https://github.com/xibosignage/xibo-cms/commit/ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff · Note
• https://github.com/dasgarner/xibo-cms/commit/a81044e6ccdd92cc967e34c125bd8162432e51bc.diff · Note
• https://xibosignage.com/blog/security-advisory-2024-04 · Note
• https://t.me/cvenotify/76647 · Telegram Post
• https://twitter.com/CVEnew/status/1779016056222458136 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1778914930143400091 · Twitter Post