CVE-2023-33181

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-33181", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-05-17T22:25:50.696Z", "datePublished": "2023-05-30T20:57:38.437Z", "dateUpdated": "2025-01-09T18:48:26.867Z"}, "containers": {"cna": {"title": "Sensitive Information Disclosure abusing Stack Trace in Xibo CMS", "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "lang": "en", "description": "CWE-209: Generation of Error Message Containing Sensitive Information", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m"}, {"name": "https://claroty.com/team82/disclosure-dashboard", "tags": ["x_refsource_MISC"], "url": "https://claroty.com/team82/disclosure-dashboard"}, {"name": "https://xibosignage.com/blog/security-advisory-2023-05/", "tags": ["x_refsource_MISC"], "url": "https://xibosignage.com/blog/security-advisory-2023-05/"}], "affected": [{"vendor": "xibosignage", "product": "xibo-cms", "versions": [{"version": ">= 3.0.0, < 3.3.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-05-30T20:57:38.437Z"}, "descriptions": [{"lang": "en", "value": "Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading."}], "source": {"advisory": "GHSA-c9cx-ghwr-x58m", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:39:35.745Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m"}, {"name": "https://claroty.com/team82/disclosure-dashboard", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://claroty.com/team82/disclosure-dashboard"}, {"name": "https://xibosignage.com/blog/security-advisory-2023-05/", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://xibosignage.com/blog/security-advisory-2023-05/"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-09T18:48:16.050881Z", "id": "CVE-2023-33181", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-09T18:48:26.867Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m", "name": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://claroty.com/team82/disclosure-dashboard", "name": "https://claroty.com/team82/disclosure-dashboard", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://xibosignage.com/blog/security-advisory-2023-05/", "name": "https://xibosignage.com/blog/security-advisory-2023-05/", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:39:35.745Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-33181", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-09T18:48:16.050881Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-09T18:48:20.809Z"}}], "cna": {"title": "Sensitive Information Disclosure abusing Stack Trace in Xibo CMS", "source": {"advisory": "GHSA-c9cx-ghwr-x58m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "xibosignage", "product": "xibo-cms", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.5"}]}], "references": [{"url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m", "name": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://claroty.com/team82/disclosure-dashboard", "name": "https://claroty.com/team82/disclosure-dashboard", "tags": ["x_refsource_MISC"]}, {"url": "https://xibosignage.com/blog/security-advisory-2023-05/", "name": "https://xibosignage.com/blog/security-advisory-2023-05/", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "CWE-209: Generation of Error Message Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-05-30T20:57:38.437Z"}}}, "cveMetadata": {"cveId": "CVE-2023-33181", "state": "PUBLISHED", "dateUpdated": "2025-01-09T18:48:26.867Z", "dateReserved": "2023-05-17T22:25:50.696Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-05-30T20:57:38.437Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "xibo-cms", "vendor": "xibosignage", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*", "matchCriteriaId": "A9A69FAF-8979-43F9-AA38-10568026EFE4", "versionEndExcluding": "3.3.5", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading."}, {"lang": "es", "value": "Xibo es un sistema de gesti\u00f3n de contenido (CMS). A partir de la versi\u00f3n 3.0.0 y antes de la versi\u00f3n 3.3.5, algunas rutas de la API imprimir\u00e1n un seguimiento de pila cuando se llamen con par\u00e1metros faltantes o inv\u00e1lidos, revelando informaci\u00f3n sensible sobre las ubicaciones de las rutas que el servidor est\u00e1 utilizando. Los usuarios deber\u00edan actualizar a la versi\u00f3n 3.3.5, que corrige este problema. No existen soluciones alternativas conocidas aparte de la actualizaci\u00f3n."}], "id": "CVE-2023-33181", "lastModified": "2026-10-28T19:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-33181", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-09T18:48:16.050881Z", "version": "2.0.3"}}]}, "published": "2023-05-30T21:15:09.207", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://claroty.com/team82/disclosure-dashboard"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://xibosignage.com/blog/security-advisory-2023-05/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://claroty.com/team82/disclosure-dashboard"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://xibosignage.com/blog/security-advisory-2023-05/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-209"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}