PT-2022-24926 · Metabase · Metabase

Ranquild · Published 2022-10-26 · Updated 2022-10-28 · CVE-2022-39358

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.44.5 Metabase versions prior to 1.44.5 Metabase versions prior to 0.43.7 Metabase versions prior to 1.43.7 Metabase versions prior to 0.42.6 Metabase versions prior to 1.42.6

Description The issue allows circumvention of locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend.

Recommendations For Metabase versions prior to 0.44.5, update to version 0.44.5 or later. For Metabase versions prior to 1.44.5, update to version 1.44.5 or later. For Metabase versions prior to 0.43.7, update to version 0.43.7 or later. For Metabase versions prior to 1.43.7, update to version 1.43.7 or later. For Metabase versions prior to 0.42.6, update to version 0.42.6 or later. For Metabase versions prior to 1.42.6, update to version 1.42.6 or later.

Exploit

Fix

Information Disclosure

Improper Locking

Weakness Enumeration

CWE-200

CWE-667

Related Identifiers

CVE-2022-39358

GHSA-8QGM-9MJ6-36H3

Affected Products

Metabase

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39358.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-39358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39358 · Security Note
• https://github.com/metabase/metabase/security/advisories/GHSA-8qgm-9mj6-36h3 · Note