CVE-2022-39359 : Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default).

Published 2022-10-26 19:15:12

Updated 2022-10-28 16:10:28

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Open redirectInformation leak

Products affected by CVE-2022-39359

Metabase » Metabase
Versions from including (>=) 0.44.0 and before (<) 0.44.5
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
Matching versions
Metabase » Metabase
Versions from including (>=) 1.42.0 and before (<) 1.42.6
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
Matching versions
Metabase » Metabase
Versions from including (>=) 1.41.0 and before (<) 1.41.9
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
Matching versions
Metabase » Metabase
Versions from including (>=) 0.43.0 and before (<) 0.43.7
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
Matching versions
Metabase » Metabase
Versions from including (>=) 1.43.0 and before (<) 1.43.7
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
Matching versions
Metabase » Metabase
Versions from including (>=) 0.41.0 and before (<) 0.41.9
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
Matching versions
Metabase » Metabase
Versions from including (>=) 0.42.0 and before (<) 0.42.6
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
Matching versions
Metabase » Metabase
Versions from including (>=) 1.44.0 and before (<) 1.44.5
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-39359

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 17 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-39359

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-39359

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: security-advisories@github.com (Secondary)
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-39359

https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e

Refactor GeoJSON URL fetching logic (#25816) (#25821) · metabase/metabase@057e2d6 · GitHub
Patch;Third Party Advisory
https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4

GeoJSON validation doesn't prevent redirects to blocked URLs · Advisory · metabase/metabase · GitHub
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-39359

Products affected by CVE-2022-39359

Exploit prediction scoring system (EPSS) score for CVE-2022-39359

CVSS scores for CVE-2022-39359

CWE ids for CVE-2022-39359

References for CVE-2022-39359