6.1

CVE-2024-54792

Exploit
A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Eng ≫ Spagobi Version3.5.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.217
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://github.com/MarioTesoro/CVE-2024-54792
Third Party Advisory
Exploit
https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-54792