CVE-2024-43412

Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute arbitrary JavaScript via the file preview function. Users can upload HTML/CSS/JS files into the Xibo Library via the Generic File module to be referenced on Displays and in Layouts. This is intended functionality. When previewing these resources from the Library and Layout editor they are executed in the users browser. This will be disabled in future releases, and users are encouraged to use the new developer tools in 4.1 to design their widgets which require this type of functionality. This behavior has been changed in 4.1.0 to preview previewing of generic files. There are no workarounds for this issue.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/xibosignage/xibo-cms/commit/d8f13339469d9f19ce591fb2bd7c9e0e0d2da118	Patch
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-336f-wrgx-57gg	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-09-03 17:15

Updated : 2024-09-12 20:20

NVD link : CVE-2024-43412

Mitre link : CVE-2024-43412

CVE.ORG link : CVE-2024-43412

JSON object : View

Products Affected

xibosignage

xibo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-43412", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-09-03T17:15:14.680", "references": [{"url": "https://github.com/xibosignage/xibo-cms/commit/d8f13339469d9f19ce591fb2bd7c9e0e0d2da118", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-336f-wrgx-57gg", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute arbitrary JavaScript via the file preview function. Users can upload HTML/CSS/JS files into the Xibo Library via the Generic File module to be referenced on Displays and in Layouts. This is intended functionality. When previewing these resources from the Library and Layout editor they are executed in the users browser. This will be disabled in future releases, and users are encouraged to use the new developer tools in 4.1 to design their widgets which require this type of functionality. This behavior has been changed in 4.1.0 to preview previewing of generic files. There are no workarounds for this issue."}, {"lang": "es", "value": "Xibo es una plataforma de se\u00f1alizaci\u00f3n digital de c\u00f3digo abierto con un sistema de gesti\u00f3n de contenido web (CMS). Antes de la versi\u00f3n 4.1.0, una vulnerabilidad de cross-site scripting en Xibo CMS permit\u00eda a los usuarios autorizados ejecutar c\u00f3digo JavaScript arbitrario a trav\u00e9s de la funci\u00f3n de vista previa de archivos. Los usuarios pueden cargar archivos HTML/CSS/JS en la librer\u00eda Xibo a trav\u00e9s del m\u00f3dulo Archivo gen\u00e9rico para que se haga referencia a ellos en las pantallas y en los dise\u00f1os. Esta es una funcionalidad prevista. Al obtener una vista previa de estos recursos desde la librer\u00eda y el editor de dise\u00f1os, se ejecutan en el navegador del usuario. Esta funci\u00f3n se desactivar\u00e1 en futuras versiones y se recomienda a los usuarios que utilicen las nuevas herramientas para desarrolladores en la versi\u00f3n 4.1 para dise\u00f1ar sus widgets que requieran este tipo de funcionalidad. Este comportamiento se ha modificado en la versi\u00f3n 4.1.0 para obtener una vista previa de los archivos gen\u00e9ricos. No existen workarounds para este problema."}], "lastModified": "2024-09-12T20:20:56.763", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BC12422-D4CD-4752-BF9A-8E5956BEBCC1", "versionEndExcluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}