CVE-2024-29023

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be granted access to the session page, or be a super admin. Users should upgrade to version 3.3.10 or 4.0.9 which fix this issue. Customers who host their CMS with the Xibo Signage service have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running. Patches are available for earlier versions of Xibo CMS that are out of security support: 2.3 patch ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff. 1.8 patch a81044e6ccdd92cc967e34c125bd8162432e51bc.diff. There are no known workarounds for this vulnerability.

• CWE-200

• https://github.com/dasgarner/xibo-cms/commit/a81044e6ccdd92cc967e34c125bd8162432e51bc.diff
• https://github.com/xibosignage/xibo-cms/commit/3b93636aa7aea07d1f7dfa36b63b773ac16d7cde
• https://github.com/xibosignage/xibo-cms/commit/49f018fd9fe64fcd417d7c2ef96078bd7b2b88b7
• https://github.com/xibosignage/xibo-cms/commit/ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-xmc6-cfq5-hg39
• https://xibosignage.com/blog/security-advisory-2024-04
• https://github.com/dasgarner/xibo-cms/commit/a81044e6ccdd92cc967e34c125bd8162432e51bc.diff
• https://github.com/xibosignage/xibo-cms/commit/3b93636aa7aea07d1f7dfa36b63b773ac16d7cde
• https://github.com/xibosignage/xibo-cms/commit/49f018fd9fe64fcd417d7c2ef96078bd7b2b88b7
• https://github.com/xibosignage/xibo-cms/commit/ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-xmc6-cfq5-hg39
• https://xibosignage.com/blog/security-advisory-2024-04

Published

Apr 12, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29018Moby is an open source container framework that is a key com…7.5
• CVE-2024-29019ESPHome is a system to control microcontrollers remotely thr…8.1
• CVE-2024-2902A vulnerability was found in Tenda AC7 15.03.06.44 and class…8.8
• CVE-2024-29020JumpServer is an open source bastion host and an operation a…5.3
• CVE-2024-29021Judge0 is an open-source online code execution system. The d…9
• CVE-2024-29022Xibo is an Open Source Digital Signage platform with a web c…8.8
• CVE-2024-29024JumpServer is an open source bastion host and an operation a…5.3
• CVE-2024-29025Netty is an asynchronous event-driven network application fr…5.3
• CVE-2024-29026Owncast is an open source, self-hosted, decentralized, singl…9.1
• CVE-2024-29027Parse Server is an open source backend that can be deployed …9
• CVE-2024-29028memos is a privacy-first, lightweight note-taking service. I…5.3
• CVE-2024-29029memos is a privacy-first, lightweight note-taking service. I…6.1