CVE-2022-43776

2022-10-2600:00:00

tenable

www.cve.org

metabase

geojson

ssrf

vulnerability

versions <44.5

301 redirect

302 redirect

0.001 Low

EPSS

Percentile

33.0%

JSON

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Metabase",
    "versions": [
      {
        "version": "<44.5",
        "status": "affected"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2022-34

0.001 Low

EPSS

Percentile

33.0%

JSON

Related for CVELIST:CVE-2022-43776