CVE-2022-39360
Estado: ModificadaMedia (6.5)—
Metabase es un software de visualización de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9, los usuarios de inicio de sesión único (SSO) podían restablecer sus contraseñas en Metabase, lo que podía permitir el acceso de un usuario sin pasar por el IdP de SSO. Este problema ha sido corregido en las versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9. Metabase ahora bloquea el restablecimiento de la contraseña para todos los usuarios que usan SSO para su inicio de sesión en Metabase
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.54%
- Percentil entre todas las CVEs puntuadas: 44
- Fecha de la puntuación: 8/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-287, CWE-304
- CWE-287
Referencias
- https://github.com/metabase/metabase/commit/edadf7303c3b068609f57ca073e67885d5c98730
- https://github.com/metabase/metabase/security/advisories/GHSA-gw4g-ww2m-v7vc
- https://github.com/metabase/metabase/commit/edadf7303c3b068609f57ca073e67885d5c98730
- https://github.com/metabase/metabase/security/advisories/GHSA-gw4g-ww2m-v7vc
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-39360",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-39360",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-04-23T13:55:35.522682Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "metabase",
"product": "metabase",
"versions": [
{
"status": "affected",
"version": "< 0.41.9"
},
{
"status": "affected",
"version": ">= 0.42.0, < 0.42.6"
},
{
"status": "affected",
"version": ">= 0.43.0, < 0.43.7"
},
{
"status": "affected",
"version": ">= 0.44.0, < 0.44.5"
},
{
"status": "affected",
"version": ">= 1.0.0, < 1.41.9"
},
{
"status": "affected",
"version": ">= 1.42.0, < 1.42.6"
},
{
"status": "affected",
"version": ">= 1.43.0, < 1.43.7"
},
{
"status": "affected",
"version": ">= 1.44.0, < 1.44.5"
}
]
}
]
}
],
"published": "2022-10-26T19:15:13.657",
"references": [
{
"url": "https://github.com/metabase/metabase/commit/edadf7303c3b068609f57ca073e67885d5c98730",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-gw4g-ww2m-v7vc",
"tags": [
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/metabase/metabase/commit/edadf7303c3b068609f57ca073e67885d5c98730",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-gw4g-ww2m-v7vc",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-287"
},
{
"lang": "en",
"value": "CWE-304"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password reset for all users who use SSO for their Metabase login."
},
{
"lang": "es",
"value": "Metabase es un software de visualización de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9, los usuarios de inicio de sesión único (SSO) podían restablecer sus contraseñas en Metabase, lo que podía permitir el acceso de un usuario sin pasar por el IdP de SSO. Este problema ha sido corregido en las versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9. Metabase ahora bloquea el restablecimiento de la contraseña para todos los usuarios que usan SSO para su inicio de sesión en Metabase"
}
],
"lastModified": "2026-06-17T04:58:12.857",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BCD50540-E323-41CE-9D9C-EDA8CB718E42",
"versionEndExcluding": "0.41.9",
"versionStartIncluding": "0.41.0"
},
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF01C7BF-CB4C-4990-9082-587CFD555225",
"versionEndExcluding": "0.42.6",
"versionStartIncluding": "0.42.0"
},
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8858058E-C597-4752-8625-9B279DC65A48",
"versionEndExcluding": "0.43.7",
"versionStartIncluding": "0.43.0"
},
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A94F7EA-BC18-4013-9A93-7962226FDD98",
"versionEndExcluding": "0.44.5",
"versionStartIncluding": "0.44.0"
},
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "804B84E1-5D1A-4251-9829-65F5FD927D99",
"versionEndExcluding": "1.41.9",
"versionStartIncluding": "1.41.0"
},
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73310924-8CD4-4696-89B9-EED3390375A6",
"versionEndExcluding": "1.42.6",
"versionStartIncluding": "1.42.0"
},
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A86AA0C8-2C4F-4DDD-8371-6B43611E2479",
"versionEndExcluding": "1.43.7",
"versionStartIncluding": "1.43.0"
},
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF7A60F6-5062-4094-91A5-71445F9B7BC1",
"versionEndExcluding": "1.44.5",
"versionStartIncluding": "1.44.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}