CVE-2022-24855
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2022
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
XSS vulnerability in Metabase
Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall to `/_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
metabase
- Vendor
- metabase
- Product
- metabase
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| >= 1.40.0, < 1.40.8 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 0.40.0, < 0.40.8 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.41.0, < 1.41.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 0.41.0, < 0.41.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.42.0, < 1.42.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 0.42.0, < 0.42.4 | affected | Unavailable | Unavailable | Unavailable | None listed |