CVE-2022-39358

2022-10-2619:15:10

Google

osv.dev

metabase

data visualization

locked parameters

embedded dashboard

malicious request

backend

patched

security issue

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.4%

JSON

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.

CPENameOperatorVersion
metabaseeq0.42.3
metabaseeq0.42.5
metabaseeq1.42.2
metabaseeq1.42.4
metabaseeq0.42.2
metabaseeq1.42.3
metabaseeq0.42.4
metabaseeq0.42.1
metabaseeq0.42.4.1
metabaseeq1.42.5

Name	Operator	Version
metabase	eq	0.42.3
metabase	eq	0.42.5
metabase	eq	1.42.2
metabase	eq	1.42.4
metabase	eq	0.42.2
metabase	eq	1.42.3
metabase	eq	0.42.4
metabase	eq	0.42.1
metabase	eq	0.42.4.1
metabase	eq	1.42.5