PT-2025-3072 · Spagobi · Spagobi

Mariotesoro · Published 2025-01-21 · Updated 2025-10-17 · CVE-2024-54792

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SpagoBI version 3.5.1

Description A Cross-Site Request Forgery (CSRF) issue has been found in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, such as adding, editing, or deleting users.

Recommendations For SpagoBI version 3.5.1, consider disabling access to the user administration panel until a patch is available to prevent potential exploitation of the CSRF issue. Restrict access to sensitive functions like adding, editing, or deleting users to minimize the risk of unwanted actions being executed.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-54792

Affected Products

Spagobi

References · 8

• 🔥 https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-54792 · Exploit
• 🔥 https://github.com/MarioTesoro/CVE-2024-54792 · Exploit
• https://osv.dev/vulnerability/CVE-2024-54792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54792 · Security Note
• https://t.me/cveNotify/139190 · Telegram Post
• https://twitter.com/CVEnew/status/1881768587863687547 · Twitter Post
• https://t.me/cvenotify/127529 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1881785281386303516 · Twitter Post