CVE-2022-39360CWE-287CWE-304

Metabase SSO users able to circumvent IdP login by doing password reset

Medium · published October 26, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
44.7
In the wild
Unconfirmed
What it is

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password reset for all users who use SSO for their Metabase login.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00541 · 44.7th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-304 · Missing Critical Step in Authentication
Published
2022-10-26T00:00Z
EPSS history
Timeline
  • 26 OCT 00:00Z
    Metabase SSO users able to circumvent IdP login by doing password reset
    cvelistv5