CVE-2022-39358CWE-200

Metabase vulnerable to circumvention of Locked parameter in Signed Embedding

Medium · published October 26, 2022

CVSS v3.1
6.5
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00485 · 40.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-10-26T00:00Z
EPSS history
Timeline
  • 26 OCT 00:00Z
    Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
    cvelistv5