CVEvulnerability

CVE-2022-39358

6.5 MEDIUM Published 2022-10-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-10-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-667

Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.

Affected configurations

• metabase metabase (>= 0.42.0 < 0.42.6) • metabase metabase (>= 0.43.0 < 0.43.7) • metabase metabase (>= 0.44.0 < 0.44.5) • metabase metabase (>= 1.42.0 < 1.42.6) • metabase metabase (>= 1.43.0 < 1.43.7) • metabase metabase (>= 1.44.0 < 1.44.5)

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-667 Improper Locking weakness

References