CVE-2022-24853

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24853
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24853.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-24853
Aliases
  • GHSA-5cfq-582c-c38m
Published
2022-04-14T21:45:16Z
Modified
2025-11-28T03:37:52.192235Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
File system exposure in Metabase
Details

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an NTLM relay attack, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24853.json"
}
References

Affected packages

Git / github.com/metabase/metabase

Affected ranges

Type
GIT
Repo
https://github.com/metabase/metabase
Events
Introduced
961caedc9983dfef7e25dfdfb0e18c9bde02dca4
Fixed
07fdc713d224160285ff8ad84190b00876f5d85a
Database specific 
{
    "versions": [
        {
            "introduced": "1.40.0"
        },
        {
            "fixed": "1.40.7"
        },
        {
            "introduced": "0.40.0"
        },
        {
            "fixed": "0.40.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/metabase/metabase
Events
Introduced
c529fe2f7a6be48354fedd8f36c940b787bafa2d
Fixed
296635f4dce086b4e4f6f244e1e128763f6d41b4
Database specific 
{
    "versions": [
        {
            "introduced": "1.41.0"
        },
        {
            "fixed": "1.41.6"
        },
        {
            "introduced": "0.41.0"
        },
        {
            "fixed": "0.41.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/metabase/metabase
Events
Introduced
de1264e1b2c3516181a3e115803abe32b74a1b7b
Fixed
33fb26887d4ce0797f9bb157b21ad066b5c12424
Database specific 
{
    "versions": [
        {
            "introduced": "1.42.0"
        },
        {
            "fixed": "1.42.3"
        },
        {
            "introduced": "0.42.0"
        },
        {
            "fixed": "0.42.3"
        }
    ]
}

Affected versions

v0.*
v0.40.0
v0.40.1
v0.40.2
v0.40.3
v0.40.3.1
v0.40.4
v0.40.5
v0.40.6
v0.41.0
v0.41.1
v0.41.2
v0.41.3
v0.41.3.1
v0.41.5
v0.42.0
v0.42.1
v0.42.2
v1.*
v1.40.0
v1.40.1
v1.40.2
v1.40.3
v1.40.3.1
v1.40.4
v1.40.5
v1.40.6
v1.41.0
v1.41.1
v1.41.2
v1.41.3
v1.41.3.1
v1.41.5
v1.42.0
v1.42.1
v1.42.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24853.json"