What’s Vulnerable › Vulnerabilities

CVE-2023-33181: Sensitive Information Disclosure abusing Stack Trace in Xibo CMS

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-30 · updated 2026-10-28
• Weakness: CWE-209

Description

Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.

Affected products

• xibosignage xibo-cms: from 3.0.0 before 3.3.5 — fixed in 3.3.5

How to fix

Upgrade to a fixed version: xibosignage xibo-cms 3.3.5. Check the vendor advisory for mitigations.

References

• https://claroty.com/team82/disclosure-dashboard
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m
• https://xibosignage.com/blog/security-advisory-2023-05/
• https://claroty.com/team82/disclosure-dashboard
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m
• https://xibosignage.com/blog/security-advisory-2023-05/

Get alerted when CVE-2023-33181 or the next vulnerability affects your stack