Lucene search
HistoryOct 26, 2022 - 6:15 p.m.
CVE-2022-43776
metabase
geojson
server side request forgery
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
32.9%
The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects.
Affected configurations
Node
metabasemetabaseRange<0.44.5
Related
osv
osv
CVE-2022-43776
2022-10-26 18:15:11
cve
cve
CVE-2022-43776
2022-10-26 18:15:11
cvelist
cvelist
CVE-2022-43776
2022-10-26 00:00:00
prion
prion
Server side request forgery (ssrf)
2022-10-26 18:15:00
wallarmlab
wallarmlab
Q4-2022 API ThreatStats™ Report
2023-02-22 16:02:55
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
32.9%
Related for NVD:CVE-2022-43776