CVE-2022-24853

File system exposure in Metabase

State: Published
Severity: 5.9 Medium
Published: Apr 14, 2022
Updated: Apr 22, 2025
Reserved: Feb 10, 2022

Description

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
metabasemetabase	>= 1.40.0, < 1.40.7Affected >= 0.40.0, < 0.40.7Affected >= 1.41.0, < 1.41.6Affected >= 0.41.0, < 0.41.6Affected >= 1.42.0, < 1.42.3Affected >= 0.42.0, < 0.42.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.