« Volver al listado

CVE-2022-39361

Estado: ModificadaAlta (8.8)—

Metabase es un software de visualización de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9, H2 (base de datos de muestra) podía permitir una ejecución de código remota (RCE), de la que podían abusar los usuarios capaces de escribir consultas SQL en las bases de datos H2. Este problema está parcheado en versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9. Metabase ya no permite las sentencias DDL en las consultas nativas H2

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Metabase — Metabase

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-39361",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-39361",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T15:47:22.654466Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "metabase",
          "product": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.41.9"
            },
            {
              "status": "affected",
              "version": ">= 0.42.0, < 0.42.6"
            },
            {
              "status": "affected",
              "version": ">= 0.43.0, < 0.43.7"
            },
            {
              "status": "affected",
              "version": ">= 0.44.0, < 0.44.5"
            },
            {
              "status": "affected",
              "version": ">= 1.0.0, < 1.41.9"
            },
            {
              "status": "affected",
              "version": ">= 1.42.0, < 1.42.6"
            },
            {
              "status": "affected",
              "version": ">= 1.43.0, < 1.43.7"
            },
            {
              "status": "affected",
              "version": ">= 1.44.0, < 1.44.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-26T19:15:14.707",
  "references": [
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-gqpj-wcr3-p88v",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-gqpj-wcr3-p88v",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-441"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL statements in H2 native queries."
    },
    {
      "lang": "es",
      "value": "Metabase es un software de visualización de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9, H2 (base de datos de muestra) podía permitir una ejecución de código remota (RCE), de la que podían abusar los usuarios capaces de escribir consultas SQL en las bases de datos H2. Este problema está parcheado en versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9. Metabase ya no permite las sentencias DDL en las consultas nativas H2"
    }
  ],
  "lastModified": "2026-06-17T04:58:12.977",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCD50540-E323-41CE-9D9C-EDA8CB718E42",
              "versionEndExcluding": "0.41.9",
              "versionStartIncluding": "0.41.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF01C7BF-CB4C-4990-9082-587CFD555225",
              "versionEndExcluding": "0.42.6",
              "versionStartIncluding": "0.42.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8858058E-C597-4752-8625-9B279DC65A48",
              "versionEndExcluding": "0.43.7",
              "versionStartIncluding": "0.43.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A94F7EA-BC18-4013-9A93-7962226FDD98",
              "versionEndExcluding": "0.44.5",
              "versionStartIncluding": "0.44.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "804B84E1-5D1A-4251-9829-65F5FD927D99",
              "versionEndExcluding": "1.41.9",
              "versionStartIncluding": "1.41.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73310924-8CD4-4696-89B9-EED3390375A6",
              "versionEndExcluding": "1.42.6",
              "versionStartIncluding": "1.42.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A86AA0C8-2C4F-4DDD-8371-6B43611E2479",
              "versionEndExcluding": "1.43.7",
              "versionStartIncluding": "1.43.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF7A60F6-5062-4094-91A5-71445F9B7BC1",
              "versionEndExcluding": "1.44.5",
              "versionStartIncluding": "1.44.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}