CVE-2022-39358

Published Oct 26, 2022

Last updated 2 years ago

CVSS medium 6.5

Overview

Description: Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.
Source: security-advisories@github.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-667
security-advisories@github.com: CWE-200

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EF01C7BF-CB4C-4990-9082-587CFD555225",
            "versionEndExcluding": "0.42.6",
            "versionStartIncluding": "0.42.0"
          },
          {
            "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8858058E-C597-4752-8625-9B279DC65A48",
            "versionEndExcluding": "0.43.7",
            "versionStartIncluding": "0.43.0"
          },
          {
            "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6A94F7EA-BC18-4013-9A93-7962226FDD98",
            "versionEndExcluding": "0.44.5",
            "versionStartIncluding": "0.44.0"
          },
          {
            "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "73310924-8CD4-4696-89B9-EED3390375A6",
            "versionEndExcluding": "1.42.6",
            "versionStartIncluding": "1.42.0"
          },
          {
            "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A86AA0C8-2C4F-4DDD-8371-6B43611E2479",
            "versionEndExcluding": "1.43.7",
            "versionStartIncluding": "1.43.0"
          },
          {
            "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EF7A60F6-5062-4094-91A5-71445F9B7BC1",
            "versionEndExcluding": "1.44.5",
            "versionStartIncluding": "1.44.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References