Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor shows the query and gives the user the option to manually run the query if they want.
References
| Link | Resource |
|---|---|
| https://github.com/metabase/metabase/commit/b7c6bb905a9187347cfc9035443b514713027a5c | Patch Third Party Advisory |
| https://github.com/metabase/metabase/security/advisories/GHSA-93wj-fgjg-r238 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
28 Oct 2022, 16:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-Other | |
| First Time |
Metabase
Metabase metabase |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | (MISC) https://github.com/metabase/metabase/commit/b7c6bb905a9187347cfc9035443b514713027a5c - Patch, Third Party Advisory | |
| References | (CONFIRM) https://github.com/metabase/metabase/security/advisories/GHSA-93wj-fgjg-r238 - Third Party Advisory |
26 Oct 2022, 19:38
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-26 19:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-39362
Mitre link : CVE-2022-39362
CVE.ORG link : CVE-2022-39362
JSON object : View
Products Affected
metabase
- metabase
CWE