SpagoBI 3.5.1 Command Injection

SpagoBI versions 3.5.1 and below suffer from a command injection vulnerability. CVE-2024-54794 Severity : Critical 9.1 CVSS score : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Summary : Engineering Ingegneria Informatica SpagoBI version 3.5.1 is affected by Command Injection vulnerability in the...

CVE-2024-54794

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution...

CVE-2024-54792

A Cross-Site Request Forgery CSRF vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users...

CVE-2024-54794

Summary: CVE-2024-54794 affects SpagoBI 3.5.1 and earlier, where the script input feature enables arbitrary code execution through Groovy script input. This is a command-injection style vulnerability in the web UI that can be exploited by a user with access to insert scripts, potentially leading ...