CVEvulnerability

CVE-2022-39361

8.8 HIGH Published 2022-10-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-10-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-441

Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL statements in H2 native queries.

Affected configurations

• metabase metabase (>= 0.41.0 < 0.41.9) • metabase metabase (>= 0.42.0 < 0.42.6) • metabase metabase (>= 0.43.0 < 0.43.7) • metabase metabase (>= 0.44.0 < 0.44.5) • metabase metabase (>= 1.41.0 < 1.41.9) • metabase metabase (>= 1.42.0 < 1.42.6) • metabase metabase (>= 1.43.0 < 1.43.7) • metabase metabase (>= 1.44.0 < 1.44.5)

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-441 Unintended Proxy or Intermediary weakness

References