Feature image

Security Advisory - 5 issues affecting the CMS

Share

We recommend everyone upgrade to 2.3.17 or 3.3.5 as soon as possible. All affected CMS instances on our Cloud platform have been fully patched. For further information on each advisory please see the CVE link below.

Thanks to Noam Moshe of Claroty Research - Team82 for responsibly disclosing these vulnerabilities and allowing us time to release 2.3.17/3.3.5.

Issue #1 - Path Traversal and RCE
It is possible for a logged in user of the CMS to upload a specially constructed ZIP file which will place malicious files on the web server and achieve remote code execution.
Versions affected: 1.8.0 and later. Fixed in 2.3.17 and 3.3.5

The configuration of our Cloud platform makes this exploit significantly harder or potentially impossible to exploit.

CVE-2023-33177

Issue #2 - SQL Injection
It is possible for a logged in user of the CMS to use SQL injection to pull sensitive information from the database.
Versions affected: 1.4.0 and later. Fixed in 2.3.17 and 3.3.5

CVE-2023-33178

Issue #3 - SQL Injection
It is possible for a logged in user of the CMS to use SQL injection to pull sensitive information from the database.
Versions affected: 3.2.0 and later. Fixed in 3.3.5

CVE-2023-33179

Issue #4 - SQL Injection
It is possible for a logged in user of the CMS to use SQL injection to pull sensitive information from the database.
Versions affected: 3.2.0 and later. Fixed in 3.3.5

CVE-2023-33180

Issue #5 - Exposed Stack Trace
Information related to the directory structure on the server was output in an error message.
Versions affected: 3.0.0 and later. Fixed in 3.3.5

CVE-2023-33181

More

Read more from the blog

View Post

Xibo for Tizen v4 R406

Announcing Xibo for Tizen v4 R406. This latest patch introduces a security enhancement.

View Post
View Post

Xibo for webOS v4 R409

Announcing Xibo for webOS v4 R409. This latest patch introduces a security enhancement.

View Post
View Post

Xibo CMS v4.2.3 Released

Announcing the release of our latest update, v4.2.3. This patch release includes 11 enhancements and 25 fixes, improving customer experience and stability of the platform.

View Post

More

Read more from the blog

View Post

Xibo for Tizen v4 R406

Announcing Xibo for Tizen v4 R406. This latest patch introduces a security enhancement.

View Post
View Post

Xibo for webOS v4 R409

Announcing Xibo for webOS v4 R409. This latest patch introduces a security enhancement.

View Post
View Post

Xibo CMS v4.2.3 Released

Announcing the release of our latest update, v4.2.3. This patch release includes 11 enhancements and 25 fixes, improving customer experience and stability of the platform.

View Post