Xibo-cms, an open source digital signage platform, contains an SSRF vulnerability (CWE-918) in versions before 4.4.1. Authenticated users with DataSet permissions can abuse this flaw to send arbitrary HTTP requests from the CMS server, potentially accessing internal network resources, cloud metadata services, or unauthenticated internal services. This vulnerability requires elevated privileges that are not standard for non-admin users. The vendor has released version 4.4.1 to address this issue. The product is cloud-hosted, so the vendor manages remediation for the cloud service. The CVSS 3.1 base score is 4.9, reflecting medium severity with high confidentiality impact but no integrity or availability impact.

Exploitation allows an authenticated user with DataSet permissions to perform SSRF attacks from the CMS server. This can lead to unauthorized access to internal network resources, cloud metadata endpoints (e.g., AWS IMDS), and internal services lacking authentication. Confidentiality of sensitive information may be compromised. There is no impact on integrity or availability according to the CVSS vector. No known exploits in the wild have been reported.

A fixed version 4.4.1 of xibo-cms is available and upgrading to this version is necessary to remediate the vulnerability. Since this is a cloud-hosted service, the vendor manages remediation for the cloud environment; users should verify with the vendor that their service instance is updated. For users unable to upgrade immediately, it is recommended to revoke DataSet privileges from users who are not fully trusted to prevent exploitation.