CVE-2022-39358: Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-39358?
CVE-2022-39358 is a vulnerability in Metabase data visualization software that allows circumvention of locked parameters when requesting data for a question in an embedded dashboard.
What versions of Metabase are affected by CVE-2022-39358?
Metabase versions 0.42.0 to 0.42.6, 0.43.0 to 0.43.7, 0.44.0 to 0.44.5, 1.42.0 to 1.42.6, 1.43.0 to 1.43.7, and 1.44.0 to 1.44.5 are affected by CVE-2022-39358.
How severe is CVE-2022-39358?
CVE-2022-39358 has a severity score of 6.5, which is considered medium.
How can I fix CVE-2022-39358?
To fix CVE-2022-39358, you should update Metabase to a version that includes the patch for this vulnerability.
Where can I find more information about CVE-2022-39358?
You can find more information about CVE-2022-39358 on the Metabase GitHub security advisories page: [GitHub Advisory](https://github.com/metabase/metabase/security/advisories/GHSA-8qgm-9mj6-36h3).