CVE-2022-39361

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL statements in H2 native queries.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*

History

28 Oct 2022, 16:43

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.8
References (CONFIRM) https://github.com/metabase/metabase/security/advisories/GHSA-gqpj-wcr3-p88v - (CONFIRM) https://github.com/metabase/metabase/security/advisories/GHSA-gqpj-wcr3-p88v - Third Party Advisory
First Time Metabase
Metabase metabase
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*

26 Oct 2022, 19:38

Type Values Removed Values Added
New CVE

Information

Published : 2022-10-26 19:15

Updated : 2023-12-10 14:35


NVD link : CVE-2022-39361

Mitre link : CVE-2022-39361

CVE.ORG link : CVE-2022-39361


JSON object : View

Products Affected

metabase

  • metabase
CWE
NVD-CWE-noinfo CWE-20

Improper Input Validation

CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')