CVE-2022-39358

{"id": "CVE-2022-39358", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-10-26T19:15:10.240", "references": [{"url": "https://github.com/metabase/metabase/security/advisories/GHSA-8qgm-9mj6-36h3", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-667"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6."}, {"lang": "es", "value": "Metabase es un software de visualizaci\u00f3n de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6 y 1.42.6, era posible omitir los par\u00e1metros bloqueados cuando se solicitaban datos para una pregunta en un tablero de mando insertado al construir una petici\u00f3n maliciosa al backend. Este problema est\u00e1 parcheado en versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6 y 1.42.6"}], "lastModified": "2022-10-28T16:04:03.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF01C7BF-CB4C-4990-9082-587CFD555225", "versionEndExcluding": "0.42.6", "versionStartIncluding": "0.42.0"}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8858058E-C597-4752-8625-9B279DC65A48", "versionEndExcluding": "0.43.7", "versionStartIncluding": "0.43.0"}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A94F7EA-BC18-4013-9A93-7962226FDD98", "versionEndExcluding": "0.44.5", "versionStartIncluding": "0.44.0"}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73310924-8CD4-4696-89B9-EED3390375A6", "versionEndExcluding": "1.42.6", "versionStartIncluding": "1.42.0"}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A86AA0C8-2C4F-4DDD-8371-6B43611E2479", "versionEndExcluding": "1.43.7", "versionStartIncluding": "1.43.0"}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF7A60F6-5062-4094-91A5-71445F9B7BC1", "versionEndExcluding": "1.44.5", "versionStartIncluding": "1.44.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}