Critical · published January 21, 2025
🚨 A single script input can lead to full arbitrary code execution in SpagoBI 3.5.1! 🔥 Think of it like leaving the front door of your house wide open while you’re away — anyone can stroll in and take control of everything inside without so much as a knock. An attacker could execute any code they choose, potentially leading to data theft, system manipulation, or even a complete system compromise. This vulnerability is absolutely devastating because it allows unauthorized access to sensitive information and critical functions of the application.
Think of it like leaving the front door of your house wide open while you’re away — anyone can stroll in and take control of everything inside without so much as a knock. CVE-2024-54794 is a critical vulnerability in SpagoBI 3.5.1 where the script input feature does not properly sanitize user input, allowing attackers to inject and execute arbitrary code on the server.
An attacker could execute any code they choose, potentially leading to data theft, system manipulation, or even a complete system compromise. This vulnerability is absolutely devastating because it allows unauthorized access to sensitive information and critical functions of the application. Immediately update SpagoBI to version 3.5.2 or later, which contains the necessary patches. Additionally, review and sanitize all script inputs to ensure no malicious code can be executed. You’ve got this! Follow these steps, and you’ll lock it down in no time. 🛡️