CVE-2022-24855

metabase

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-24855

Katalog CVE

CVSS 5.4 · Medium EPSS 0,71%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada metabase. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall to `/_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

Rincian

Terbit di NVD
14 April 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari)
0,71% peluang dieksploitasi; lebih tinggi dari 52,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
metabase metabase Versi 0.40.0 hingga sebelum 0.40.8
metabase metabase Versi 0.41.0 hingga sebelum 0.41.7
metabase metabase Versi 0.42.0 hingga sebelum 0.42.4
metabase metabase Versi 1.40.0 hingga sebelum 1.40.8
metabase metabase Versi 1.41.0 hingga sebelum 1.41.7
metabase metabase Versi 1.42.0 hingga sebelum 1.42.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.