CVE-2022-24855
Last modified
CVE-2022-24855 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. EPSS estimates a 0.67% chance of exploitation in the next 30 days.
Description
Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall to `/_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Metabase | Metabase | >= 0.40.0, < 0.40.8 |
| Metabase | Metabase | >= 0.41.0, < 0.41.7 |
| Metabase | Metabase | >= 0.42.0, < 0.42.4 |
| Metabase | Metabase | >= 1.40.0, < 1.40.8 |
| Metabase | Metabase | >= 1.41.0, < 1.41.7 |
| Metabase | Metabase | >= 1.42.0, < 1.42.4 |
References
- https://github.com/metabase/metabase/releases/tag/v0.42.4Release Notes, Third Party Advisory
- https://github.com/metabase/metabase/security/advisories/GHSA-wjw6-wm9w-7ggrRelease Notes, Third Party Advisory
- https://github.com/metabase/metabase/releases/tag/v0.42.4Release Notes, Third Party Advisory
- https://github.com/metabase/metabase/security/advisories/GHSA-wjw6-wm9w-7ggrRelease Notes, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-24855?
How severe is CVE-2022-24855?
How do I fix CVE-2022-24855?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-24849DisCatSharp is a Discord API wrapper for .NET. Users of vers…6.5
- CVE-2022-2485Any attempt (good or bad) to log into AutomationDirect Strid…7.5
- CVE-2022-24850Discourse is an open source platform for community discussio…4.3
- CVE-2022-24851LDAP Account Manager (LAM) is an open source web frontend fo…4.8
- CVE-2022-24853Metabase is an open source business intelligence and analyti…5.3
- CVE-2022-24854Metabase is an open source business intelligence and analyti…8.8
- CVE-2022-24856FlyteConsole is the web user interface for the Flyte platfor…7.5
- CVE-2022-24857django-mfa3 is a library that implements multi factor authen…8.8
- CVE-2022-24858next-auth v3 users before version 3.29.2 are impacted. next-…6.1
- CVE-2022-24859PyPDF2 is an open source python PDF library capable of split…5.5
- CVE-2022-2486A vulnerability, which was classified as critical, was found…9.8
- CVE-2022-24860Databasir is a team-oriented relational database model docum…9.8
Are you affected by CVE-2022-24855?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST