CVE-2023-33181 MEDIUM

CVE-2023-33181: Sensitive Information Disclosure abusing Stack Trace in Xibo CMS

Vendor Xibosignage
Product xibo-cms
Weakness CWE-209 · Error message info leak
Published May 30, 2023
Last update January 9, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.

Key dates

02Disclosure timeline

May 30, 2023 CVE published
January 9, 2025 Record updated