CVE-2024-41802

Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import

State: Published
Severity: 8.1 High
Published: Jul 30, 2024
Updated: Aug 2, 2024
Reserved: Jul 22, 2024

Description

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the APIs for importing JSON and importing a Layout containing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
xibo-cmsxibosignage	=> 1.8.0, < 3.3.12Affected => 4.0.0-alpha, < 4.0.14Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.