CVE-2022-39358
Dashboard / Vulnerabilities / CVE-2022-39358
Summary: Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
Details: Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.
References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39358.json, https://github.com/metabase/metabase/security/advisories/GHSA-8qgm-9mj6-36h3, https://nvd.nist.gov/vuln/detail/CVE-2022-39358
Affected packages
Package
Name:
Purl:
Affected ranges
Type: GIT
Events:
Introduced- de1264e1b2c3516181a3e115803abe32b74a1b7b
Affected versions
v1.42.5
v1.42.4.1
v1.42.4
v1.42.3
v1.42.2
v1.42.1
v1.42.0
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
