CVE-2024-43413CWE-79

Xibo CMS XSS vulnerability using DataSet HTML columns

Low · published September 3, 2024

CVSS v3.1
3.5
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is

Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00279 · 19.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-09-03T18:52Z
EPSS history
Timeline
  • 03 SEP 18:52Z
    Xibo CMS XSS vulnerability using DataSet HTML columns
    cvelistv5