Feature image

Security Advisory - 5 issues affecting the CMS

Share

We recommend everyone upgrade to 2.3.17 or 3.3.5 as soon as possible. All affected CMS instances on our Cloud platform have been fully patched. For further information on each advisory please see the CVE link below.

Thanks to Noam Moshe of Claroty Research - Team82 for responsibly disclosing these vulnerabilities and allowing us time to release 2.3.17/3.3.5.

Issue #1 - Path Traversal and RCE
It is possible for a logged in user of the CMS to upload a specially constructed ZIP file which will place malicious files on the web server and achieve remote code execution.
Versions affected: 1.8.0 and later. Fixed in 2.3.17 and 3.3.5

The configuration of our Cloud platform makes this exploit significantly harder or potentially impossible to exploit.

CVE-2023-33177

Issue #2 - SQL Injection
It is possible for a logged in user of the CMS to use SQL injection to pull sensitive information from the database.
Versions affected: 1.4.0 and later. Fixed in 2.3.17 and 3.3.5

CVE-2023-33178

Issue #3 - SQL Injection
It is possible for a logged in user of the CMS to use SQL injection to pull sensitive information from the database.
Versions affected: 3.2.0 and later. Fixed in 3.3.5

CVE-2023-33179

Issue #4 - SQL Injection
It is possible for a logged in user of the CMS to use SQL injection to pull sensitive information from the database.
Versions affected: 3.2.0 and later. Fixed in 3.3.5

CVE-2023-33180

Issue #5 - Exposed Stack Trace
Information related to the directory structure on the server was output in an error message.
Versions affected: 3.0.0 and later. Fixed in 3.3.5

CVE-2023-33181

More

Read more from the blog

View Post

Xibo for webOS v4 R403

We are pleased to announce Xibo for webOS v4 R403 which fixes 3 issues.

View Post
View Post

Xibo for webOS v3 R312

We are pleased to announce Xibo for webOS v3 R312 which resolve 1 issue.

View Post
View Post

Xibo for Tizen v4 R402

We are pleased to announce Xibo for Tizen v4 R402 which addresses 3 issues.

View Post

More

Read more from the blog

View Post

Xibo for webOS v4 R403

We are pleased to announce Xibo for webOS v4 R403 which fixes 3 issues.

View Post
View Post

Xibo for webOS v3 R312

We are pleased to announce Xibo for webOS v3 R312 which resolve 1 issue.

View Post
View Post

Xibo for Tizen v4 R402

We are pleased to announce Xibo for Tizen v4 R402 which addresses 3 issues.

View Post