CVE-2023-33180 MEDIUM

CVE-2023-33180: Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map

Vendor Xibosignage
Product xibo-cms
Weakness CWE-89 · SQLi
Published May 30, 2023
Last update January 9, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the `/display/map` API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `bounds` parameter. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.

Key dates

02Disclosure timeline

May 30, 2023 CVE published
January 9, 2025 Record updated