PT-2022-16929 · Metabase · Metabase

Bananabr · Published 2022-04-14 · Updated 2022-04-22 · CVE-2022-24855

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.40.8 and 1.40.8 Metabase versions prior to 0.41.7 and 1.41.7 Metabase versions prior to 0.42.4 and 1.42.4

Description Metabase is an open source business intelligence and analytics application. In affected versions, Metabase ships with an internal development endpoint / internal that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover.

Recommendations For Metabase versions prior to 0.40.8 and 1.40.8, upgrade to version 0.40.8 or 1.40.8 or block access in your firewall to / internal endpoints. For Metabase versions prior to 0.41.7 and 1.41.7, upgrade to version 0.41.7 or 1.41.7 or block access in your firewall to / internal endpoints. For Metabase versions prior to 0.42.4 and 1.42.4, upgrade to version 0.42.4 or 1.42.4 or block access in your firewall to / internal endpoints.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24855

GHSA-WJW6-WM9W-7GGR

Affected Products

Metabase

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24855.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24855 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24855 · Vendor Advisory
• https://github.com/metabase/metabase/releases/tag/v0.42.4 · Note
• https://github.com/metabase/metabase/security/advisories/GHSA-wjw6-wm9w-7ggr · Note
• https://t.me/cvenotify/28971 · Telegram Post
• https://t.me/cibsecurity/40839 · Telegram Post