CVE-2023-33180
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
An SQL injection vulnerability was discovered in the Xibo content management system in the `/display/map` API route, affecting versions from 3.2.0 to 3.3.2. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values into the `bounds` parameter.
Risk Assessment
This vulnerability could lead to unauthorized access to sensitive data in the database, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
Original NVD description (English source)
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the `/display/map` API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `bounds` parameter. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.