CVE-2022-39359 - Vulnerability Details - OpenCVE

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Metabase	Metabase

Configuration 1 [-]

OR	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::
	cpe:2.3:a:metabase:metabase::::::::

No data.

References

Link	Providers
https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e
https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-10-26T00:00:00

Updated: 2024-08-03T12:00:44.147Z

Reserved: 2022-09-02T00:00:00

Link: CVE-2022-39359

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-10-26T19:15:12.410

Modified: 2024-11-21T07:18:06.803

Link: CVE-2022-39359

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-39359", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "dateUpdated": "2024-08-03T12:00:44.147Z", "dateReserved": "2022-09-02T00:00:00", "datePublished": "2022-10-26T00:00:00"}, "containers": {"cna": {"title": "Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs", "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-10-26T00:00:00"}, "descriptions": [{"lang": "en", "value": "Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default)."}], "affected": [{"vendor": "metabase", "product": "metabase", "versions": [{"version": "< 0.41.9", "status": "affected"}, {"version": ">= 0.42.0, < 0.42.6", "status": "affected"}, {"version": ">= 0.43.0, < 0.43.7", "status": "affected"}, {"version": ">= 0.44.0, < 0.44.5", "status": "affected"}, {"version": ">= 1.0.0, < 1.41.9", "status": "affected"}, {"version": ">= 1.42.0, < 1.42.6", "status": "affected"}, {"version": ">= 1.43.0, < 1.43.7", "status": "affected"}, {"version": ">= 1.44.0, < 1.44.5", "status": "affected"}]}], "references": [{"url": "https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4"}, {"url": "https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200"}]}], "source": {"advisory": "GHSA-w5j7-4mgm-77f4", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:00:44.147Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4", "tags": ["x_transferred"]}, {"url": "https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "matchCriteriaId": "BCD50540-E323-41CE-9D9C-EDA8CB718E42", "versionEndExcluding": "0.41.9", "versionStartIncluding": "0.41.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF01C7BF-CB4C-4990-9082-587CFD555225", "versionEndExcluding": "0.42.6", "versionStartIncluding": "0.42.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "matchCriteriaId": "8858058E-C597-4752-8625-9B279DC65A48", "versionEndExcluding": "0.43.7", "versionStartIncluding": "0.43.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A94F7EA-BC18-4013-9A93-7962226FDD98", "versionEndExcluding": "0.44.5", "versionStartIncluding": "0.44.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "matchCriteriaId": "804B84E1-5D1A-4251-9829-65F5FD927D99", "versionEndExcluding": "1.41.9", "versionStartIncluding": "1.41.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "matchCriteriaId": "73310924-8CD4-4696-89B9-EED3390375A6", "versionEndExcluding": "1.42.6", "versionStartIncluding": "1.42.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "matchCriteriaId": "A86AA0C8-2C4F-4DDD-8371-6B43611E2479", "versionEndExcluding": "1.43.7", "versionStartIncluding": "1.43.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF7A60F6-5062-4094-91A5-71445F9B7BC1", "versionEndExcluding": "1.44.5", "versionStartIncluding": "1.44.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default)."}, {"lang": "es", "value": "Metabase es un software de visualizaci\u00f3n de datos. En versiones anteriores a 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9, las direcciones URL de los mapas GeoJSON personalizados segu\u00edan redireccionamientos a direcciones que no estaban permitidas, como link-local o private-network. Este problema ha sido corregido en versiones 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9 y 1.41.9. Metabase ya no sigue los redireccionamientos en las URL de mapas GeoJSON. Tambi\u00e9n fue a\u00f1adida una variable de entorno \"MB_CUSTOM_GEOJSON_ENABLED\" para deshabilitar completamente el GeoJSON personalizado (\"true\" por defecto)"}], "id": "CVE-2022-39359", "lastModified": "2024-11-21T07:18:06.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-26T19:15:12.410", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}]}