CVE-2024-41804
6.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Summary
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the formula parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| xibosignage | xibo-cms | => 2.1.0, < 3.3.12 | affected |
| xibosignage | xibo-cms | => 4.0.0-alpha, < 4.0.14 | affected |
Weaknesses
- CWE-89: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
CVE Program Container
Additional References
- https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-4pp3-4mw7-qfwr
- https://github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patch
- https://xibosignage.com/blog/security-advisory-2024-07
References
- https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-4pp3-4mw7-qfwr
- https://github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patch
- https://xibosignage.com/blog/security-advisory-2024-07
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.