« Volver al listado

CVE-2024-41944

Estado: AplazadaMedia (6.5)—

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `sortBy` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Xibosignage — XiboAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-41944",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-41944",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-30T16:39:27.628296Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "xibosignage",
          "product": "xibo-cms",
          "versions": [
            {
              "status": "affected",
              "version": "=> 2.1.0, < 3.3.12"
            },
            {
              "status": "affected",
              "version": "=> 4.0.0-alpha, < 4.0.14"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:xibosignage:xibo:2.1.0:*:*:*:*:*:*:*"
          ],
          "vendor": "xibosignage",
          "product": "xibo",
          "versions": [
            {
              "status": "affected",
              "version": "2.1.0",
              "lessThan": "3.3.12",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:xibosignage:xibo:4.0.0:alpha:*:*:*:*:*:*"
          ],
          "vendor": "xibosignage",
          "product": "xibo",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.14",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-30T17:15:13.853",
  "references": [
    {
      "url": "https://github.com/xibosignage/xibo-cms/commit/c60cfd8727da77b9db10297148eadd697ebec353.patch",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6q4-h869-gm3r",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://xibosignage.com/blog/security-advisory-2024-07",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xibosignage/xibo-cms/commit/c60cfd8727da77b9db10297148eadd697ebec353.patch",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6q4-h869-gm3r",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://xibosignage.com/blog/security-advisory-2024-07",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `sortBy` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue."
    },
    {
      "lang": "es",
      "value": " Xibo es un sistema de gestión de contenidos (CMS). Se descubrió una vulnerabilidad de inyección SQL en la ruta API `report/data/proofofplayReport` dentro del CMS. Esto permite a un usuario autenticado obtener y modificar datos arbitrarios de la base de datos Xibo inyectando valores especialmente diseñados en el parámetro \"sortBy\". Los usuarios deben actualizar a la versión 3.3.12 o 4.0.14, que soluciona este problema."
    }
  ],
  "lastModified": "2026-06-17T07:48:30.183",
  "sourceIdentifier": "security-advisories@github.com"
}