Vulnerability · Published Dec 16, 2024 · Assigned by GitHub_M

CVE-2024-55951Metabase sandboxed users could see filter values from other sandboxed users

Medium 4.8

In plain English

A medium-severity information exposure in metabase from metabase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.4%top 61.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There are no workarounds for this issue aside from upgrading.

Affected products (as reported)

Vendor	Product	Versions
metabase	metabase	>= 1.52.0, < 1.52.2.5

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://github.com/metabase/metabase/security/advisories/GHSA-rhjf-q2qw-rvx3 x_refsource_CONFIRM
https://downloads.metabase.com/v0.52.2.5/metabase.jar x_refsource_MISC
https://hub.docker.com/r/metabase/metabase/tags x_refsource_MISC