CVE-2022-24855

XSS vulnerability in Metabase

High8.7EPSS 0.71%

Published: 14 Apr 2022
Updated: 23 Apr 2025
Reserved: 10 Feb 2022
Assigned by: GitHub_M

Description

Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall to `/_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

Timeline

2022
10 Feb 2022
10 Feb 2022
ID reserved
By GitHub_M
14 Apr 20222 months later
14 Apr 2022· 2 months later
Published
2025
23 Apr 20253 years later
23 Apr 2025· 3 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-24855, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	High8.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
NVDNVD · Modified	3.1	Medium5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.71% · top 46% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

metabase · metabase
- affected >= 1.40.0, < 1.40.8
- affected >= 0.40.0, < 0.40.8
- affected >= 1.41.0, < 1.41.7
- affected >= 0.41.0, < 0.41.7
- affected >= 1.42.0, < 1.42.4
- affected >= 0.42.0, < 0.42.4

References (2)

https://github.com/metabase/metabase/security/advisories/GHSA-wjw6-wm9w-7ggr (opens in a new tab)x_refsource_CONFIRMx_transferred
https://github.com/metabase/metabase/releases/tag/v0.42.4 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-24855](https://trackcve.app/badge/CVE-2022-24855.svg)](https://trackcve.app/cve/CVE-2022-24855)

Record last updated 23 Apr 2025, 18:39 UTC.