CVE-2014-7296 The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURE_SECURE_PROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL....
MediumCVSS 6.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURE_SECURE_PROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eng spagobi | = 5.0 | No fix listed |
References
- spagoworld.org vendor-advisory
- 70240 vdb-entry