PT-2025-3073 · Spagobi · Spagobi

Mariotesoro · Published 2025-01-21 · Updated 2025-10-17 · CVE-2024-54795

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SpagoBI version 3.5.1

Description The issue concerns multiple Stored Cross-Site Scripting (XSS) vulnerabilities found in the create/edit forms of the worksheet designer function. This allows for the potential execution of malicious scripts, impacting the security of the application.

Recommendations For SpagoBI version 3.5.1, consider disabling the create/edit forms of the worksheet designer function until a patch is available to mitigate the risk of Stored Cross-Site Scripting (XSS) attacks. Restrict access to these forms to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-54795

Affected Products

Spagobi

References · 9

• 🔥 https://github.com/MarioTesoro/CVE-2024-54795 · Exploit
• 🔥 https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-54795 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-54795 · Security Note
• https://osv.dev/vulnerability/CVE-2024-54795 · Vendor Advisory
• https://t.me/cvenotify/127531 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1881785310314414408 · Twitter Post
• https://twitter.com/CVEnew/status/1881806580267831379 · Twitter Post
• https://t.me/cveNotify/139192 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1881785316798853597 · Twitter Post