Design/Logic Flaw

2022-10-2619:15:00

PRIOn knowledge base

www.prio-n.com

metabase

data visualization

logic flaw

security patch

embedded dashboard

circumvention.

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.4%

JSON

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.

CPENameOperatorVersion
metabasege1.42.0
metabaselt1.42.6
metabasege1.43.0
metabaselt1.43.7
metabasege1.44.0
metabaselt1.44.5
metabasege0.42.0
metabaselt0.42.6
metabasege0.43.0
metabaselt0.43.7

Name	Operator	Version
metabase	ge	1.42.0
metabase	lt	1.42.6
metabase	ge	1.43.0
metabase	lt	1.43.7
metabase	ge	1.44.0
metabase	lt	1.44.5
metabase	ge	0.42.0
metabase	lt	0.42.6
metabase	ge	0.43.0
metabase	lt	0.43.7