Log in Start free

Vulnerability · Published Apr 12, 2024 · Assigned by GitHub_M

CVE-2024-29023Session Hijacking via token exposure on the session page in Xibo CMS

High 7.2

In plain English

A high-severity information exposure in xibo-cms from xibosignage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.8%top 43.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be granted access to the session page, or be a super admin. Users should upgrade to version 3.3.10 or 4.0.9 which fix this issue. Customers who host their CMS with the Xibo Signage service have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running. Patches are available for earlier versions of Xibo CMS that are out of security support: 2.3 patch ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff. 1.8 patch a81044e6ccdd92cc967e34c125bd8162432e51bc.diff. There are no known workarounds for this vulnerability.

Affected products (as reported)

VendorProductVersions
xibosignage xibo-cms >= 1.8.0, < 3.3.10>= 4.0.0, < 4.0.9

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References