CVE-2022-39359

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default).

CVSS v3.0 6.5 MEDIUM

6.5^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4	Third Party Advisory
https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e	Patch Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::

Information

Published : 2022-10-26 12:15

Updated : 2022-10-28 09:10

NVD link : CVE-2022-39359

Mitre link : CVE-2022-39359

JSON object : View

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

Advertisement

Products Affected

metabase

metabase

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4", "name": "https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e", "name": "https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-601"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-39359", "ASSIGNER": "security-advisories@github.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}}, "publishedDate": "2022-10-26T19:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.42.6", "versionStartIncluding": "1.42.0"}, {"cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.43.7", "versionStartIncluding": "1.43.0"}, {"cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.44.5", "versionStartIncluding": "1.44.0"}, {"cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "0.42.6", "versionStartIncluding": "0.42.0"}, {"cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "0.43.7", "versionStartIncluding": "0.43.0"}, {"cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "0.44.5", "versionStartIncluding": "0.44.0"}, {"cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.41.9", "versionStartIncluding": "1.41.0"}, {"cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "0.41.9", "versionStartIncluding": "0.41.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-10-28T16:10Z"}