CVE-2024-55951CWE-200

Metabase sandboxed users could see filter values from other sandboxed users

Medium · published December 16, 2024

CVSS v4.0
4.8
EPSS
0%
Percentile
37.0
In the wild
Unconfirmed
What it is

Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There are no workarounds for this issue aside from upgrading.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00437 · 37.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-12-16T20:03Z
EPSS history
Timeline
  • 16 DEC 20:03Z
    Metabase sandboxed users could see filter values from other sandboxed users
    cvelistv5