CVE-2023-33181 Sensitive Information Disclosure abusing Stack Trace in Xibo CMS
Attackers can obtain sensitive server path information via stack traces in Xibo CMS API routes when invalid parameters are provided.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33181?
CVE-2023-33181 is a medium-severity vulnerability in xibosignage xibo-cms, published on 30 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
Weakness: CWE-209
Which versions are affected by CVE-2023-33181?
It affects 1 product.
Products include Xibosignage Xibo.
How do I fix CVE-2023-33181?
No fix has been published for CVE-2023-33181 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-33181 being exploited?
There is no known exploitation of CVE-2023-33181 in the wild and no public exploit code.
Other vulnerabilities in xibosignage xibo-cms
- CVE-2023-33177 Xibo CMS vulnerable to Remote Code Execution through Zip Slip
- CVE-2024-41802 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import
- CVE-2026-31952 Xibo CMS API has SQL Injection via DataSet Filter Parameter
- CVE-2013-4887 SQL injection in n/a
- CVE-2025-62369 Xibo CMS: Remote Code Execution through module templates
Sources
Also known as GHSA-c9cx-ghwr-x58m.