Strix
26.1K

CVE-2022-24853

MEDIUMCVSS 5.3/10EPSS 2.44%

Last modified

CVE-2022-24853 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. EPSS estimates a 2.44% chance of exploitation in the next 30 days.

Description

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Probability
2.44%

82.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
MetabaseMetabase>= 0.40.0, < 0.40.8
MetabaseMetabase>= 0.41.0, < 0.41.7
MetabaseMetabase>= 0.42.0, < 0.42.4
MetabaseMetabase>= 1.40.0, < 1.40.8
MetabaseMetabase>= 1.41.0, < 1.41.7
MetabaseMetabase>= 1.42.0, < 1.42.4

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-24853?
Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.
How severe is CVE-2022-24853?
CVE-2022-24853 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 2.44% probability of exploitation in the next 30 days.
How do I fix CVE-2022-24853?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-24853?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST