CVE-2023-33179

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-33179

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33179.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-33179

Aliases

GHSA-jmx8-cgm4-7mf5

Published

2023-05-30T20:07:13.870Z

Modified

2026-07-08T06:26:21.863760212Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter

Details

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the nameFilter function used throughout the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical operators. Users should upgrade to version 3.3.5 which fixes this issue. There are no known workarounds aside from upgrading.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33179.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ]
}

References

Affected packages

Git / github.com/xibosignage/xibo-cms

Affected ranges

Type

GIT

Repo

https://github.com/xibosignage/xibo-cms

Events

Introduced

4453faac47d80fc0a6241aa2da7123cb0b3afd90

Fixed

6f5d4dd0c4a177faca6268a322a557afd4e17296

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.3.5"
        }
    ]
}

Affected versions

3.*

3.2.0

3.2.1

3.3.0

3.3.1

3.3.2

3.3.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33179.json"