CVE-2023-33181
Assigner: GitHub_M
Published: 2023-05-30T20:57:38.437Z
State: PUBLISHED
title: Sensitive Information Disclosure abusing Stack Trace in Xibo CMS
problemTypes: descriptions: cweId: CWE-209
description: CWE-209: Generation of Error Message Containing Sensitive Information
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
affected: vendor: xibosignage
product: xibo-cms
versions: version: >= 3.0.0, < 3.3.5
status: affected
descriptions: value: Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
source: advisory: GHSA-c9cx-ghwr-x58m
discovery: UNKNOWN