Medium severity · published Apr 14, 2022
CVE-2022-24855
Metabase is an open source business intelligence and analytics application
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall to `/_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Metabase · Metabase
0.40.0 before 0.40.8; 0.41.0 before 0.41.7; 0.42.0 before 0.42.4; 1.40.0 before 1.40.8; 1.41.0 before 1.41.7; 1.42.0 before 1.42.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24855
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24855
Release Notes
https://github.com/metabase/metabase/releases/tag/v0.42.4
Release Notes
https://github.com/metabase/metabase/security/advisories/GHSA-wjw6-wm9w-7ggr
More from Metabase
10.0
CVE-2026-72898
Metabase SQL injection via password reset endpoint
7.5
CVE-2021-41277
GeoJSON URL validation can expose server files and environment variables to unauthorized users
10.0
CVE-2026-72899
Metabase SQL injection via public card or dashboard
9.8
CVE-2023-37470
Metabase is an open-source business intelligence and analytics platform
9.8
CVE-2023-38646
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level