CVE-2022-39358

Metabase vulnerable to circumvention of Locked parameter in Signed Embedding

Medium6.5EPSS 0.54%

Published: 26 Oct 2022
Updated: 23 Apr 2025
Reserved: 2 Sept 2022
Assigned by: GitHub_M

Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.

Timeline

2022
2 Sept 2022
2 Sept 2022
ID reserved
By GitHub_M
26 Oct 202254 days later
26 Oct 2022· 54 days later
Published
2025
23 Apr 20252 years later
23 Apr 2025· 2 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-39358, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Modified	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.54% · top 54% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

Affected products

metabase · metabase
- affected < 0.42.6
- affected >= 0.43.0, < 0.43.7
- affected >= 0.44.0, < 0.44.5
- affected >= 1.0.0, < 1.42.6
- affected >= 1.43.0, < 1.43.7
- affected >= 1.44.0, < 1.44.5

References (1)

https://github.com/metabase/metabase/security/advisories/GHSA-8qgm-9mj6-36h3 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-39358](https://trackcve.app/badge/CVE-2022-39358.svg)](https://trackcve.app/cve/CVE-2022-39358)

Record last updated 23 Apr 2025, 16:42 UTC.