CVEvulnerability

CVE-2022-39360

6.5 MEDIUM Published 2022-10-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-10-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-287, CWE-304

Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password reset for all users who use SSO for their Metabase login.

Affected configurations

• metabase metabase (>= 0.41.0 < 0.41.9) • metabase metabase (>= 0.42.0 < 0.42.6) • metabase metabase (>= 0.43.0 < 0.43.7) • metabase metabase (>= 0.44.0 < 0.44.5) • metabase metabase (>= 1.41.0 < 1.41.9) • metabase metabase (>= 1.42.0 < 1.42.6) • metabase metabase (>= 1.43.0 < 1.43.7) • metabase metabase (>= 1.44.0 < 1.44.5)

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-304 Missing Critical Step in Authentication weakness

References