Engineering SpagoBI 跨站脚本漏洞

Engineering SpagoBI is an open source Business Intelligence suite based on the J2EE framework from the Italian company Engineering. The suite is mainly used to manage BI objects such as reports, scorecards, and data mining models, which can be controlled, validated, verified and distributed throu...

CVE-2024-54792

A Cross-Site Request Forgery CSRF vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users...

CVE-2024-54792

CVE-2024-54792 : SpagoBI 3.5.1 is affected by a CSRF vulnerability in the user administration panel. An authenticated attacker can induce a logged-in admin to perform unwanted actions (e.g., add/edit/delete users) on behalf of the victim via crafted requests. The issue is demonstrated in multiple...

Exploit for Cross-Site Request Forgery (CSRF) in Eng Spagobi

CVE-2024-54792 Severity : Medium 6.1 CVSS sc...

PT-2025-1233 · Spagobi · Spagobi

Name of the Vulnerable Software and Affected Versions: SpagoBI version 3.5.1 Description: The issue is related to the script input feature of SpagoBI, which allows arbitrary code execution. This is due to the lack of measures to neutralize special elements used in the command input field...

CVE-2013-6231

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script...

Privilege escalation

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script...

CVE-2013-6231

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script...

CVE-2013-6231

CVE-2013-6231 affects SpagoBI (primarily SpagoBI 4.0). The vulnerability is a privilege-escalation flaw in the AdapterHTTP servlet (ACTION_NAME=MANAGE_USER_ACTION) that can be triggered by crafted input, enabling a remote attacker to gain Administrator privileges after authenticating. Remediation...

CVE-2013-6234

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, aka "XSS File Upload...

Unrestricted file upload

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, aka "XSS File Upload...

CVE-2013-6234

CVE-2013-6234 describes an unrestricted file upload vulnerability in the SpagoBI Worksheet designer (versions before 4.1). A remote, authenticated user could upload a file with an executable extension and access it via a direct request to the file in an unspecified directory, enabling arbitrary c...

CVE-2013-6234

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, aka "XSS File Upload...

Cross site scripting

Knowage formerly SpagoBI 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue...

Cross site scripting

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-12355

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-12355

CVE-2018-12355 affects Knowage (formerly SpagoBI) 6.1.1 with a cross-site scripting vulnerability in the Olap Schemas’ Catalogue exposed via the name or description fields. Multiple sources corroborate an XSS in Knowage 6.1.1; the vulnerability enables injection of arbitrary scripts through the s...

CVE-2018-12353

Knowage (formerly SpagoBI) 6.1.1 is affected by a Cross-Site Scripting (XSS) vulnerability in the name field of the Business Model’s Catalogue, leading to script injection in the catalogue view. The issue is documented as CVE-2018-12353 with public references indicating XSS via the name field and...

CVE-2018-12354

Knowage (formerly SpagoBI) 6.1.1 is documented as vulnerable to cross-site request forgery (CSRF) via every form, demonstrated by a POST to /knowage/restful-services/2.0/analyticalDrivers/. CVE-2018-12354 is assessed with CVSS v3.0 base score 8.8 (HIGH) and CVSS v2.0 base score 6.8 (MEDIUM) indic...

SpagoBI remote code execution vulnerability analysis requires authentication permissions-bug warning-the black bar safety net

Today we publish the second article—SpagoBI remote code execution vulnerability. In this article, I want to talk about SpagoBI And SpagoBI is a free open source Business Intelligence Suite, which consists of the Engineering Group's SpagoBI Labswww.eng.it SpagoBI Labs develop and manage, its goal ...