CVE-2024-43413

Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/xibosignage/xibo-cms/commit/009527855d8bfd0ffb95f5c88ed72b7b5bdebfa1	Patch
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-pfxp-vxh7-2h9f	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-09-03 19:15

Updated : 2024-09-12 20:18

NVD link : CVE-2024-43413

Mitre link : CVE-2024-43413

CVE.ORG link : CVE-2024-43413

JSON object : View

Products Affected

xibosignage

xibo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-43413", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2024-09-03T19:15:14.590", "references": [{"url": "https://github.com/xibosignage/xibo-cms/commit/009527855d8bfd0ffb95f5c88ed72b7b5bdebfa1", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-pfxp-vxh7-2h9f", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue."}, {"lang": "es", "value": "Xibo es una plataforma de se\u00f1alizaci\u00f3n digital de c\u00f3digo abierto con un sistema de gesti\u00f3n de contenido web (CMS). Antes de la versi\u00f3n 4.1.0, una vulnerabilidad de cross-site scripting en Xibo CMS permit\u00eda a los usuarios autorizados ejecutar JavaScript a trav\u00e9s de la funcionalidad DataSet. Los usuarios pueden dise\u00f1ar un DataSet con una columna HTML que contenga JavaScript, que es la funcionalidad prevista. El JavaScript se ejecuta en la p\u00e1gina de entrada de datos y en cualquier dise\u00f1o que haga referencia a \u00e9l. Este comportamiento se ha modificado en la versi\u00f3n 4.1.0 para mostrar HTML/CSS/JS como c\u00f3digo en la p\u00e1gina de entrada de datos. No existen workarounds para este problema."}], "lastModified": "2024-09-12T20:18:46.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BC12422-D4CD-4752-BF9A-8E5956BEBCC1", "versionEndExcluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}