CVE-2022-24855

XSS vulnerability in Metabase

State: Published
Severity: 8.7 High
Published: Apr 14, 2022
Updated: Apr 23, 2025
Reserved: Feb 10, 2022

Description

Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall to `/_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

Scores

CVSS	Score	Vector	Source
3.1	8.7 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
metabasemetabase	>= 1.40.0, < 1.40.8Affected >= 0.40.0, < 0.40.8Affected >= 1.41.0, < 1.41.7Affected >= 0.41.0, < 0.41.7Affected >= 1.42.0, < 1.42.4Affected >= 0.42.0, < 0.42.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.