Medium severity · published Jan 21, 2025
CVE-2024-54792
A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spagobi · Eng
3.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-54792
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-54792
Exploit
https://github.com/MarioTesoro/CVE-2024-54792
github.com
https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-54792
More from Spagobi
9.1
CVE-2024-54794
The script input feature of SpagoBI 3.5.1 allows arbitrary code execution
8.8
CVE-2013-6231
SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script
8.0
CVE-2013-6234
Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an…
5.4
CVE-2024-54795
SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function
–
CVE-2014-7296
The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURE_SECURE_PROCESSING, which allows remote authenticated users to execute arbitrary Java…