CVE-2024-43413

{"id": "CVE-2024-43413", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.9}]}, "published": "2024-09-03T19:15:14.590", "references": [{"url": "https://github.com/xibosignage/xibo-cms/commit/009527855d8bfd0ffb95f5c88ed72b7b5bdebfa1", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-pfxp-vxh7-2h9f", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue."}, {"lang": "es", "value": "Xibo es una plataforma de se\u00f1alizaci\u00f3n digital de c\u00f3digo abierto con un sistema de gesti\u00f3n de contenido web (CMS). Antes de la versi\u00f3n 4.1.0, una vulnerabilidad de cross-site scripting en Xibo CMS permit\u00eda a los usuarios autorizados ejecutar JavaScript a trav\u00e9s de la funcionalidad DataSet. Los usuarios pueden dise\u00f1ar un DataSet con una columna HTML que contenga JavaScript, que es la funcionalidad prevista. El JavaScript se ejecuta en la p\u00e1gina de entrada de datos y en cualquier dise\u00f1o que haga referencia a \u00e9l. Este comportamiento se ha modificado en la versi\u00f3n 4.1.0 para mostrar HTML/CSS/JS como c\u00f3digo en la p\u00e1gina de entrada de datos. No existen workarounds para este problema."}], "lastModified": "2024-09-12T20:18:46.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BC12422-D4CD-4752-BF9A-8E5956BEBCC1", "versionEndExcluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}