---
title: July 2024 Security Advisory - Xibo CMS
description: July 2024 Security Advisory. We recommend everyone upgrade to 3.3.12 or 4.0.14 as soon as possible.
---

[Blog | Xibo Digital Signage ](https://xibosignage.com/blog)

# [July 2024 Security Advisory - Xibo CMS](https://xibosignage.com/blog/security-advisory-2024-07)

 Written by [Dan](https://xibosignage.com/blog/author/dan) | Jul 29, 2024 11:00:00 PM

We recommend everyone upgrade to 3.3.12 or 4.0.14 or latest release as soon as possible. All affected CMS instances on our Cloud platform have been fully patched. For further information on each advisory please see the CVE link below.

Thanks to Sergey Bobrov (Kaspersky, [https://kaspersky.com/](https://kaspersky.com/)) for responsibly disclosing these vulnerabilities and allowing us time to release 3.3.12/4.0.14.

Disclosure Timeline

11th July 18:00 - First advisory submitted  
11th July 20:00 - Xibo acknowledged and provided patches for the issue. Xibo confirmed the issue does not effect Xibo Cloud Hosting.  
12th July 09:00 to 11:00 - Draft security advisories were submitted  
12th July 18:00 - 2 of the 3 issues acknowledged and recreated by Xibo, patches produced and applied to Xibo Cloud Hosting  
15th July 08:30 - Remaining issue recreated by Xibo and patches applied to Xibo Cloud Hosting  
15th July 14:08 - 3.3.12 released  
15th July 14:24 - 4.0.14 released  
30th July - Public disclosure

Issue #1 - Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report

An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `sortBy` parameter.

Exploitation of the vulnerability is possible on behalf of an authorized user who has the following privileges:  
- Access to Reporting feature  
- View access to arbitrary display

This is only possible for CMS instances configured to use MySQL as their time series store, which is the default configuration.

Versions affected: **2.1.0 and later. Fixed in 3.3.12 and 4.0.14**

[CVE-2024-41944](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6q4-h869-gm3r)

Issue #2 - Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import

An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the APIs for importing JSON and importing a Layout containing DataSet data.

Exploitation of the vulnerability is possible on behalf of an authorized user who has either of the following privileges:  
- Access to DataSet Feature  
- Access to the Layout Feature

Versions affected: **1.8.0 and later. Fixed in 3.3.12 and 4.0.14**

[CVE-2024-41802](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-x4qm-vvhp-g7c2)

Issue #3 - Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter

An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by injecting specially crafted values in to the API for viewing DataSet data.

Exploitation of the vulnerability is possible on behalf of an authorized user who has the following privileges:  
- Access to DataSet Feature

Versions affected: **2.1.0 and later. Fixed in 3.3.12 and 4.0.14**

[CVE-2024-41803](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-hpc5-mxfq-44hv)

Issue #4 - Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula

An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `formula` parameter.

Exploitation of the vulnerability is possible on behalf of an authorized user who has the following privileges:  
- Access to DataSet Feature

Versions affected: **2.1.0 and later. Fixed in 3.3.12 and 4.0.14**

[CVE-2024-41804](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-4pp3-4mw7-qfwr)

[View full post](https://xibosignage.com/blog/security-advisory-2024-07)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Dan"
  },
  "dateModified" : "2025-11-26T15:22:04.078Z",
  "datePublished" : "2024-07-29T23:00:00Z",
  "headline" : "Security Advisory - 4 issues affecting the CMS",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://48096235.fs1.hubspotusercontent-na1.net/hubfs/48096235/Imported_Blog_Media/f6f556a7-068b-46a7-b3d4-fd34bf7f44ec_CMS-blog-banner-2-1-1-1.png",
    "width" : 1120
  },
  "mainEntityOfPage" : "https://xibosignage.com/blog/security-advisory-2024-07",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Blog"
  }
}
```