A vulnerability was found in Metabase. It has been classified as critical. This affects an unknown functionality of the component H2 Database Handler. The manipulation with an unknown input leads to a confused deputy vulnerability. CWE is classifying the issue as CWE-441. The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL statements in H2 native queries.

The weakness was published 10/27/2022 as GHSA-gqpj-wcr3-p88v. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2022-39361 since 09/02/2022. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 or 1.41.9 eliminates this vulnerability.

Productinfo

Name

• Metabase

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion