What is CVE-2024-29023?

CVE-2024-29023 is a high-severity vulnerability in Xibosignage Xibo-Cms, classified under Information Disclosure. CVSS score: 7.2/10. Published 2024-04-12.

How severe is CVE-2024-29023?

High severity. CVSS v3 base score is 7.2 out of 10.

Is CVE-2024-29023 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Xibosignage Xibo-Cms

CVE-2024-29023

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be granted access to the session page, or be a super admin. Users should upgrade to version 3.3.10 or 4.0.9 which fix this issue. Customers who host their CMS with the Xibo Signage service have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running. Patches are available for earlier versions of Xibo CMS that are out of security support: 2.3 patch ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff. 1.8 patch a81044e6ccdd92cc967e34c125bd8162432e51bc.diff. There are no known workarounds for this vulnerability.

Vulnerability class: Information Disclosure

Published 2024-04-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.008 (54.9th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 54.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000

Affected products

Xibosignage Xibo-Cms — versions >= 1.8.0, < 3.3.10, >= 4.0.0, < 4.0.9

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

Saadet-T/Saadet-T

References

Frequently asked questions

What is CVE-2024-29023?: CVE-2024-29023 is a high-severity vulnerability in Xibosignage Xibo-Cms, classified under Information Disclosure. CVSS score: 7.2/10. Published 2024-04-12.
How severe is CVE-2024-29023?: High severity. CVSS v3 base score is 7.2 out of 10.
Is CVE-2024-29023 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.