« Volver al listado

CVE-2022-39362

Estado: ModificadaAlta (8.8)—

Metabase es un software de visualización de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9, eran auto ejecutadas las consultas SQL no guardadas, lo que podía suponer un posible vector de ataque. Este problema ha sido corregido en versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9. Metabase ya no ejecuta automáticamente las consultas nativas ad hoc. Ahora el editor nativo muestra la consulta y da al usuario la opción de ejecutarla manualmente si lo desea

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Metabase — Metabase

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-39362",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-39362",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T15:47:19.634079Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "metabase",
          "product": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.41.9"
            },
            {
              "status": "affected",
              "version": ">= 0.42.0, < 0.42.6"
            },
            {
              "status": "affected",
              "version": ">= 0.43.0, < 0.43.7"
            },
            {
              "status": "affected",
              "version": ">= 0.44.0, < 0.44.5"
            },
            {
              "status": "affected",
              "version": ">= 1.0.0, < 1.41.9"
            },
            {
              "status": "affected",
              "version": ">= 1.42.0, < 1.42.6"
            },
            {
              "status": "affected",
              "version": ">= 1.43.0, < 1.43.7"
            },
            {
              "status": "affected",
              "version": ">= 1.44.0, < 1.44.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-26T19:15:15.800",
  "references": [
    {
      "url": "https://github.com/metabase/metabase/commit/b7c6bb905a9187347cfc9035443b514713027a5c",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-93wj-fgjg-r238",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/commit/b7c6bb905a9187347cfc9035443b514713027a5c",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-93wj-fgjg-r238",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-356"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor shows the query and gives the user the option to manually run the query if they want."
    },
    {
      "lang": "es",
      "value": "Metabase es un software de visualización de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9, eran auto ejecutadas las consultas SQL no guardadas, lo que podía suponer un posible vector de ataque. Este problema ha sido corregido en versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9. Metabase ya no ejecuta automáticamente las consultas nativas ad hoc. Ahora el editor nativo muestra la consulta y da al usuario la opción de ejecutarla manualmente si lo desea"
    }
  ],
  "lastModified": "2026-06-17T04:58:13.087",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCD50540-E323-41CE-9D9C-EDA8CB718E42",
              "versionEndExcluding": "0.41.9",
              "versionStartIncluding": "0.41.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF01C7BF-CB4C-4990-9082-587CFD555225",
              "versionEndExcluding": "0.42.6",
              "versionStartIncluding": "0.42.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8858058E-C597-4752-8625-9B279DC65A48",
              "versionEndExcluding": "0.43.7",
              "versionStartIncluding": "0.43.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A94F7EA-BC18-4013-9A93-7962226FDD98",
              "versionEndExcluding": "0.44.5",
              "versionStartIncluding": "0.44.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "804B84E1-5D1A-4251-9829-65F5FD927D99",
              "versionEndExcluding": "1.41.9",
              "versionStartIncluding": "1.41.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73310924-8CD4-4696-89B9-EED3390375A6",
              "versionEndExcluding": "1.42.6",
              "versionStartIncluding": "1.42.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A86AA0C8-2C4F-4DDD-8371-6B43611E2479",
              "versionEndExcluding": "1.43.7",
              "versionStartIncluding": "1.43.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF7A60F6-5062-4094-91A5-71445F9B7BC1",
              "versionEndExcluding": "1.44.5",
              "versionStartIncluding": "1.44.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}