A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel.

Published 21 mo ago 2025-01-21 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.3%

percentile 23%

Public exploits

none known

A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: partial
Assessed: 21 mo ago 2025-01-21

Exploit prediction (EPSS)

0.30% probability of exploitation in the next 30 days, higher than 23% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
CNA	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

github.com /MarioTesoro/CVE-2024-54792
github.com /MarioTesoro/vulnerability-research/tree/main/CVE-2024-54792

Sources

CVE List: CVE-2024-54792
NVD: CVE-2024-54792

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.