CVE-2024-43413

Low

Description

Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue.

SeverityLow

CVSS3.5

Exploit probability—

ProductXibo

PublishedSep 3, 2024

First seenSep 3, 2024

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

xibosignage xibo4.1.0 or later

Affected products

Product	Affected versions	Fixed in
xibosignage xibo	v < 4.1.0	4.1.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.