CVE-2022-39362

HIGH Year: 2022
CVSS v3 Score
8.8
High
Weakness Type
CWE-356
View all →

Vulnerability Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor shows the query and gives the user the option to manually run the query if they want.

Related Vulnerabilities

CVE-2019-6736

HIGH
CVSS:8.8(High)

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that t...

CWE-3562019

CVE-2019-6737

HIGH
CVSS:8.8(High)

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that t...

CWE-3562019

CVE-2019-6738

HIGH
CVSS:8.8(High)

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that t...

CWE-3562019

CVE-2018-16858

CRITICAL
CVSS:9.8(Critical)

It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could ...

CWE-3562018

CVE-2022-35873

HIGH
CVSS:7.8(High)

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulne...

CWE-3562022

CVE-2022-36970

HIGH
CVSS:7.8(High)

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service Pack 2. User interaction is required to exploit thi...

CWE-3562022