« Volver al listado

CVE-2022-39359

Estado: ModificadaMedia (6.5)—

Metabase es un software de visualización de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9, las direcciones URL de los mapas GeoJSON personalizados seguían redireccionamientos a direcciones que no estaban permitidas, como link-local o private-network. Este problema ha sido corregido en versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9. Metabase ya no sigue los redireccionamientos en las URL de mapas GeoJSON. También fue añadida una variable de entorno "MB_CUSTOM_GEOJSON_ENABLED" para deshabilitar completamente el GeoJSON personalizado ("true" por defecto)

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Metabase — Metabase

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-39359",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-39359",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T13:55:38.846349Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "metabase",
          "product": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.41.9"
            },
            {
              "status": "affected",
              "version": ">= 0.42.0, < 0.42.6"
            },
            {
              "status": "affected",
              "version": ">= 0.43.0, < 0.43.7"
            },
            {
              "status": "affected",
              "version": ">= 0.44.0, < 0.44.5"
            },
            {
              "status": "affected",
              "version": ">= 1.0.0, < 1.41.9"
            },
            {
              "status": "affected",
              "version": ">= 1.42.0, < 1.42.6"
            },
            {
              "status": "affected",
              "version": ">= 1.43.0, < 1.43.7"
            },
            {
              "status": "affected",
              "version": ">= 1.44.0, < 1.44.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-26T19:15:12.410",
  "references": [
    {
      "url": "https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default)."
    },
    {
      "lang": "es",
      "value": "Metabase es un software de visualización de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9, las direcciones URL de los mapas GeoJSON personalizados seguían redireccionamientos a direcciones que no estaban permitidas, como link-local o private-network. Este problema ha sido corregido en versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9. Metabase ya no sigue los redireccionamientos en las URL de mapas GeoJSON. También fue añadida una variable de entorno \"MB_CUSTOM_GEOJSON_ENABLED\" para deshabilitar completamente el GeoJSON personalizado (\"true\" por defecto)"
    }
  ],
  "lastModified": "2026-06-17T04:58:12.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCD50540-E323-41CE-9D9C-EDA8CB718E42",
              "versionEndExcluding": "0.41.9",
              "versionStartIncluding": "0.41.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF01C7BF-CB4C-4990-9082-587CFD555225",
              "versionEndExcluding": "0.42.6",
              "versionStartIncluding": "0.42.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8858058E-C597-4752-8625-9B279DC65A48",
              "versionEndExcluding": "0.43.7",
              "versionStartIncluding": "0.43.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A94F7EA-BC18-4013-9A93-7962226FDD98",
              "versionEndExcluding": "0.44.5",
              "versionStartIncluding": "0.44.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "804B84E1-5D1A-4251-9829-65F5FD927D99",
              "versionEndExcluding": "1.41.9",
              "versionStartIncluding": "1.41.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73310924-8CD4-4696-89B9-EED3390375A6",
              "versionEndExcluding": "1.42.6",
              "versionStartIncluding": "1.42.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A86AA0C8-2C4F-4DDD-8371-6B43611E2479",
              "versionEndExcluding": "1.43.7",
              "versionStartIncluding": "1.43.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF7A60F6-5062-4094-91A5-71445F9B7BC1",
              "versionEndExcluding": "1.44.5",
              "versionStartIncluding": "1.44.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}