« Back to list

CVE-2022-39360

Status: ModifiedMedium (6.5)—

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password reset for all users who use SSO for their Metabase login.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Metabase — Metabase

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2022-39360",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-39360",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T13:55:35.522682Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "metabase",
          "product": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.41.9"
            },
            {
              "status": "affected",
              "version": ">= 0.42.0, < 0.42.6"
            },
            {
              "status": "affected",
              "version": ">= 0.43.0, < 0.43.7"
            },
            {
              "status": "affected",
              "version": ">= 0.44.0, < 0.44.5"
            },
            {
              "status": "affected",
              "version": ">= 1.0.0, < 1.41.9"
            },
            {
              "status": "affected",
              "version": ">= 1.42.0, < 1.42.6"
            },
            {
              "status": "affected",
              "version": ">= 1.43.0, < 1.43.7"
            },
            {
              "status": "affected",
              "version": ">= 1.44.0, < 1.44.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-26T19:15:13.657",
  "references": [
    {
      "url": "https://github.com/metabase/metabase/commit/edadf7303c3b068609f57ca073e67885d5c98730",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-gw4g-ww2m-v7vc",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/commit/edadf7303c3b068609f57ca073e67885d5c98730",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-gw4g-ww2m-v7vc",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-304"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password reset for all users who use SSO for their Metabase login."
    },
    {
      "lang": "es",
      "value": "Metabase es un software de visualización de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9, los usuarios de inicio de sesión único (SSO) podían restablecer sus contraseñas en Metabase, lo que podía permitir el acceso de un usuario sin pasar por el IdP de SSO. Este problema ha sido corregido en las versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9. Metabase ahora bloquea el restablecimiento de la contraseña para todos los usuarios que usan SSO para su inicio de sesión en Metabase"
    }
  ],
  "lastModified": "2026-06-17T04:58:12.857",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCD50540-E323-41CE-9D9C-EDA8CB718E42",
              "versionEndExcluding": "0.41.9",
              "versionStartIncluding": "0.41.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF01C7BF-CB4C-4990-9082-587CFD555225",
              "versionEndExcluding": "0.42.6",
              "versionStartIncluding": "0.42.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8858058E-C597-4752-8625-9B279DC65A48",
              "versionEndExcluding": "0.43.7",
              "versionStartIncluding": "0.43.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A94F7EA-BC18-4013-9A93-7962226FDD98",
              "versionEndExcluding": "0.44.5",
              "versionStartIncluding": "0.44.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "804B84E1-5D1A-4251-9829-65F5FD927D99",
              "versionEndExcluding": "1.41.9",
              "versionStartIncluding": "1.41.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73310924-8CD4-4696-89B9-EED3390375A6",
              "versionEndExcluding": "1.42.6",
              "versionStartIncluding": "1.42.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A86AA0C8-2C4F-4DDD-8371-6B43611E2479",
              "versionEndExcluding": "1.43.7",
              "versionStartIncluding": "1.43.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF7A60F6-5062-4094-91A5-71445F9B7BC1",
              "versionEndExcluding": "1.44.5",
              "versionStartIncluding": "1.44.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}