SpagoBI 3.5.1 Command Injection

SpagoBI versions 3.5.1 and below suffer from a command injection vulnerability. CVE-2024-54794 Severity : Critical 9.1 CVSS score : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Summary : Engineering Ingegneria Informatica SpagoBI version 3.5.1 is affected by Command Injection vulnerability in the...

CVE-2024-54794

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution...

CVE-2024-54792

A Cross-Site Request Forgery CSRF vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users...

CVE-2024-54794

Engineering Ingegneria Informatica SpagoBI version 3.5.1 and earlier are vulnerable to a Command Injection vulnerability in the script input feature. The root cause is the failure to neutralize special elements in the command input field, which allows a malicious actor to execute arbitrary code b...