# Xibo CMS flaws can lead to session hijacking (CVE-2024-29022, CVE-2024-29023)

- Date: 2024-04
- Location: Global
- Type: Vulnerability
- Sector: Other
- CVE: CVE-2024-29022, CVE-2024-29023
- Products: [Xibo](https://signagelist.org/products/xibo/)

Xibo's April 2024 advisory covered two CMS flaws, CVE-2024-29022 and CVE-2024-29023. The first is a cross-site scripting bug rated 8.8 that can lead to session hijacking, and the second is a token exposure issue rated 7.2. Xibo told users to upgrade to 3.3.10 or 4.0.9, or to the latest release.

## Sources

- [Security Advisory - 2 issues affecting the CMS](https://xibosignage.com/blog/security-advisory-2024-04) (Xibo Signage)
- [CVE-2024-29022](https://nvd.nist.gov/vuln/detail/CVE-2024-29022) (NIST NVD)
- [CVE-2024-29023](https://nvd.nist.gov/vuln/detail/CVE-2024-29023) (NIST NVD)
- [https://github.com/dasgarner/xibo-cms/commit/a81044e6ccdd92cc967e34c125bd8162432e51bc.diff](https://github.com/dasgarner/xibo-cms/commit/a81044e6ccdd92cc967e34c125bd8162432e51bc.diff)
- [https://github.com/xibosignage/xibo-cms/commit/ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff](https://github.com/xibosignage/xibo-cms/commit/ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff)

Page: https://signagelist.org/incidents/2024-04-xibo-cms-flaws-can-lead-to-session/