CVE-2022-39358
Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
Résumé
Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov