Vulnerability Description
Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xibosignage | Xibo | < 4.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/xibosignage/xibo-cms/commit/009527855d8bfd0ffb95f5c88ed72b7b5Patch
- https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-pfxp-vxh7-2h9fVendor Advisory
FAQ
What is CVE-2024-43413?
CVE-2024-43413 is a vulnerability with a CVSS score of 3.5 (LOW). Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute ...
How severe is CVE-2024-43413?
CVE-2024-43413 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-43413?
Check the references section above for vendor advisories and patch information. Affected products include: Xibosignage Xibo.