---
title: Security Advisory - 2 issues affecting the CMS
description: "We recommend everyone upgrade to 3.3.10 or 4.0.9 or latest release as soon as
possible. All affected CMS instances on our Cloud platform have been fully
patched. For further information on each advisory please see the CVE link below.

Thanks to @Saadet-T [https://github.com/Saadet-T] (Saadet Elif Tokuoğlu) for
responsibly disclosing these vulnerabilities and allowing us time to release
3.3.10/4.0.9.

Disclosure Timeline

16th March 16:00 - A draft security advisory was submitted by Saadet
17th March 16:00 - The issue was acknowledged and confirmed by Xibo
18th March 11:40 - Patches produced and applied to Xibo Cloud Hosting
18th March 13:38 - 3.3.10 released
18th March 15:01 - 4.0.9 released
11th April - Public disclosure

Issue #1 - Session Hijacking via XSS attack in header and session grid
Some request headers are not correctly sanitised when stored in the session and
display tables.

These headers can be used to inject a malicious script into the session page to
exfiltrate session IDs and User Agents. These session IDs / User Agents can
subsequently be used to hijack active sessions.

A malicious script can be injected into the display grid to exfiltrate
information related to displays.

Versions affected: 1.8.0 and later. Fixed in 3.3.10 and 4.0.9

After extensive research we have determined that CMS instances hosted via our
Cloud platform have not been exploited. All CMS instances hosted by Xibo of any
version have been patched.

CVE-2024-29022
[https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-xchw-pf2w-rpgq]

Issue #2 - Session Hijacking via token exposure on the session page
Session tokens are exposed in the return of session search API call on the
sessions page. Subsequently they can be exfiltrated and used to hijack a
session.

Users must be granted access to the session page, or be a super admin.

Versions affected: 1.8.0 and later. Fixed in 3.3.10 and 4.0.9

After extensive research we have determined that CMS instances hosted via our
Cloud platform have not been exploited. All CMS instances hosted by Xibo of any
version have been patched.

CVE-2024-29023
[https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-xmc6-cfq5-hg39]"
---

[Blog | Xibo Digital Signage ](https://xibosignage.com/blog)

# [Security Advisory - 2 issues affecting the CMS](https://xibosignage.com/blog/security-advisory-2024-04)

 Written by [Dan](https://xibosignage.com/blog/author/dan) | Apr 10, 2024 11:00:00 PM

We recommend everyone upgrade to 3.3.10 or 4.0.9 or latest release as soon as possible. All affected CMS instances on our Cloud platform have been fully patched. For further information on each advisory please see the CVE link below.

Thanks to [@Saadet-T](https://github.com/Saadet-T) (Saadet Elif Tokuoğlu) for responsibly disclosing these vulnerabilities and allowing us time to release 3.3.10/4.0.9.

Disclosure Timeline

16th March 16:00 - A draft security advisory was submitted by Saadet  
17th March 16:00 - The issue was acknowledged and confirmed by Xibo  
18th March 11:40 - Patches produced and applied to Xibo Cloud Hosting  
18th March 13:38 - 3.3.10 released  
18th March 15:01 - 4.0.9 released  
11th April - Public disclosure

Issue #1 - Session Hijacking via XSS attack in header and session grid  
Some request headers are not correctly sanitised when stored in the session and display tables.

These headers can be used to inject a malicious script into the session page to exfiltrate session IDs and User Agents. These session IDs / User Agents can subsequently be used to hijack active sessions.

A malicious script can be injected into the display grid to exfiltrate information related to displays.

Versions affected: **1.8.0 and later. Fixed in 3.3.10 and 4.0.9**

After extensive research we have determined that CMS instances hosted via our Cloud platform have not been exploited. All CMS instances hosted by Xibo of any version have been patched.

[CVE-2024-29022](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-xchw-pf2w-rpgq)

Issue #2 - Session Hijacking via token exposure on the session page  
Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session.

Users must be granted access to the session page, or be a super admin.

Versions affected: **1.8.0 and later. Fixed in 3.3.10 and 4.0.9**

After extensive research we have determined that CMS instances hosted via our Cloud platform have not been exploited. All CMS instances hosted by Xibo of any version have been patched.

[CVE-2024-29023](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-xmc6-cfq5-hg39)

[View full post](https://xibosignage.com/blog/security-advisory-2024-04)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Dan"
  },
  "dateModified" : "2025-11-26T15:29:36.768Z",
  "datePublished" : "2024-04-10T23:00:00Z",
  "headline" : "Security Advisory - 2 issues affecting the CMS",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://48096235.fs1.hubspotusercontent-na1.net/hubfs/48096235/Imported_Blog_Media/239f3ac7-2c65-48c6-8794-1d3e7667a167_CMS-blog-banner-1-1-1.png",
    "width" : 1120
  },
  "mainEntityOfPage" : "https://xibosignage.com/blog/security-advisory-2024-04",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Blog"
  }
}
```