CVE-2022-39362: Metabase vulnerable to arbitrary SQL execution from queryhash
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor shows the query and gives the user the option to manually run the query if they want.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39362?
CVE-2022-39362 is a vulnerability in Metabase data visualization software versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 that allows unsaved SQL queries to be auto-executed, creating a possible attack vector.
How severe is CVE-2022-39362?
CVE-2022-39362 has a severity score of 8.8 (high).
How can I check if my version of Metabase is affected by CVE-2022-39362?
To check if your version of Metabase is affected, compare the version number with the vulnerable versions: 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9.
How do I fix CVE-2022-39362?
To fix CVE-2022-39362, update Metabase to one of the patched versions: 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, or 1.41.9.
Where can I find more information about CVE-2022-39362?
More information about CVE-2022-39362 can be found in the Metabase GitHub repository and the Metabase security advisories.