Log in Start free

Vulnerability · Published Oct 26, 2022 · Assigned by GitHub_M

CVE-2022-39360Metabase SSO users able to circumvent IdP login by doing password reset

Medium 6.5

In plain English

A medium-severity improper authentication in metabase from metabase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 50.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password reset for all users who use SSO for their Metabase login.

Affected products (as reported)

VendorProductVersions
metabase metabase < 0.41.9>= 0.42.0, < 0.42.6>= 0.43.0, < 0.43.7>= 0.44.0, < 0.44.5>= 1.0.0, < 1.41.9>= 1.42.0, < 1.42.6>= 1.43.0, < 1.43.7>= 1.44.0, < 1.44.5

Weakness: CWE-304, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References