PT-2024-30571 · Xibo · Xibo

Sergey Bobrov · Published 2024-09-03 · Updated 2024-09-12 · CVE-2024-43413

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xibo versions prior to 4.1.0

Description A cross-site scripting issue in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. This occurs when a user designs a DataSet with an HTML column containing JavaScript, which is then executed on the Data Entry page and in any Layouts referencing it. The behavior was changed in version 4.1.0 to display HTML, CSS, and JavaScript as code on the Data Entry page.

Recommendations For versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the DataSet functionality with HTML columns until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-43413

GHSA-PFXP-VXH7-2H9F

Affected Products

Xibo

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43413.json · Exploit
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-pfxp-vxh7-2h9f · Vendor Advisory
• https://github.com/xibosignage/xibo-cms/commit/009527855d8bfd0ffb95f5c88ed72b7b5bdebfa1 · Patch
• https://osv.dev/vulnerability/CVE-2024-43413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43413 · Security Note
• https://t.me/cvedetector/4712 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1831071350066213368 · Twitter Post
• https://twitter.com/CVEnew/status/1831047925905994232 · Twitter Post