---
cve: "CVE-2023-33181"
severity: "MEDIUM"
cvss: 4.3
epss: "0.5%"
vendor: "xibosignage"
kev: false
exploited: false
published: "2023-05-30 21:15:09"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-02T08:04:58+01:00"
---

# CVE-2023-33181

> 4.3 MEDIUM · 🧪 PoC

## Beschreibung

Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2025-01-09 18:48:26
- CNA-CVSS: **4.3** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-209** — Generation of Error Message Containing Sensitive Information
  The product generates an error message that includes sensitive information about its environment, users, or associated data.

## Angriffsmuster (CAPEC)

- [CAPEC-7 — Blind SQL Injection](https://capec.mitre.org/data/definitions/7.html) _(Severity: High)_
- [CAPEC-54 — Query System for Information](https://capec.mitre.org/data/definitions/54.html) _(Severity: Low)_
- [CAPEC-215 — Fuzzing for application mapping](https://capec.mitre.org/data/definitions/215.html) _(Severity: Low)_
- [CAPEC-463 — Padding Oracle Crypto Attack](https://capec.mitre.org/data/definitions/463.html) _(Severity: High)_

## Patch verfügbar (OSV)

- 6f5d4dd0c4a177faca6268a322a557afd4e17296 (Commit)

## Referenzen

- <https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m>
- <https://claroty.com/team82/disclosure-dashboard>
- <https://xibosignage.com/blog/security-advisory-2023-05/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2023-33181/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_