SpagoBI 3.5.1 Command Injection

SpagoBI versions 3.5.1 and below suffer from a command injection vulnerability. CVE-2024-54794 Severity : Critical 9.1 CVSS score : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Summary : Engineering Ingegneria Informatica SpagoBI version 3.5.1 is affected by Command Injection vulnerability in the...

CVE-2024-54794

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution...

CVE-2024-54794

Engineering Ingegneria Informatica SpagoBI version 3.5.1 and earlier are vulnerable to a Command Injection vulnerability within the script input feature. The root cause is the failure to properly neutralize special elements in the command input field, allowing an attacker to inject and execute ar...

CVE-2024-54792

A Cross-Site Request Forgery CSRF vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users...