PT-2022-24930 · Metabase · Metabase

Abrahack · Published 2022-10-26 · Updated 2022-10-28 · CVE-2022-39362

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9

Description The issue concerns the automatic execution of unsaved SQL queries, which could pose a possible attack vector. Metabase has addressed this by no longer automatically executing ad-hoc native queries, instead giving users the option to manually run the query.

Recommendations For versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, update to version 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, or 1.41.9 to prevent automatic execution of unsaved SQL queries. As a temporary workaround, consider disabling the automatic execution of ad-hoc native queries until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-356

Related Identifiers

CVE-2022-39362

GHSA-93WJ-FGJG-R238

Affected Products

Metabase

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39362.json · Exploit
• https://github.com/metabase/metabase/commit/b7c6bb905a9187347cfc9035443b514713027a5c · Patch
• https://osv.dev/vulnerability/CVE-2022-39362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39362 · Security Note
• https://github.com/metabase/metabase/security/advisories/GHSA-93wj-fgjg-r238 · Note