CVE-2013-6231

published 2020-01-10

CVE-2013-6231: SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

Priority P2 59 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

Affected

1 ranges

Vendor	Product	Version range	Fixed in
eng	spagobi	< 4.1	4.1

Detection & IOCs extracted from sources · hover to see the quote

url https://localhost/SpagoBI/servlet/AdapterHTTP?ACTION_NAME=MANAGE_USER_ACTION↗

path /SpagoBI/servlet/AdapterHTTP↗

command ACTION_NAME=MANAGE_USER_ACTION↗

• → Detect HTTP requests to the AdapterHTTP servlet with the ACTION_NAME=MANAGE_USER_ACTION parameter, especially from non-administrative user sessions, which indicates a privilege escalation attempt. ↗
• → Alert on any authenticated low-privileged user (e.g., Business User / RSM role) invoking /SpagoBI/servlet/AdapterHTTP?ACTION_NAME=MANAGE_USER_ACTION, as this is the exact attack vector for privilege escalation to Administrator. ↗

• · The vulnerability affects SpagoBI versions before 4.1; only instances running SpagoBI 4.0 or older are exploitable. Verify the deployed version before applying detection rules. ↗
• · Exploitation requires the attacker to be authenticated (at minimum as a Business User with RSM role), so detections should correlate the request with the authenticated session role rather than treating it as unauthenticated access. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269