{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:50.469Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/metabase/metabase/security/advisories/GHSA-vm79-xvmp-7329"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.sqlite.org/lang_attach.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "metabase",
          "vendor": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.41.0, \u003c 1.41.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.41.0, \u003c 0.41.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.42.0, \u003c 1.42.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.42.0, \u003c 0.42.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file path to the second database. Users are advised to upgrade as soon as possible. If you\u0027re unable to upgrade, you can modify your SQLIte connection strings to contain the url argument `?limit_attached=0`, which will disallow making connections to other SQLite databases. Only users making use of SQLite are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-610",
              "description": "CWE-610: Externally Controlled Reference to a Resource in Another Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-14T21:40:11",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/metabase/metabase/security/advisories/GHSA-vm79-xvmp-7329"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sqlite.org/lang_attach.html"
        }
      ],
      "source": {
        "advisory": "GHSA-vm79-xvmp-7329",
        "discovery": "UNKNOWN"
      },
      "title": "Database bypassing any permissions in Metabase via SQlite attach",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24854",
          "STATE": "PUBLIC",
          "TITLE": "Database bypassing any permissions in Metabase via SQlite attach"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "metabase",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 1.41.0, \u003c 1.41.7"
                          },
                          {
                            "version_value": "\u003e= 0.41.0, \u003c 0.41.7"
                          },
                          {
                            "version_value": "\u003e= 1.42.0, \u003c 1.42.4"
                          },
                          {
                            "version_value": "\u003e= 0.42.0, \u003c 0.42.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "metabase"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file path to the second database. Users are advised to upgrade as soon as possible. If you\u0027re unable to upgrade, you can modify your SQLIte connection strings to contain the url argument `?limit_attached=0`, which will disallow making connections to other SQLite databases. Only users making use of SQLite are affected."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-610: Externally Controlled Reference to a Resource in Another Sphere"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/metabase/metabase/security/advisories/GHSA-vm79-xvmp-7329",
              "refsource": "CONFIRM",
              "url": "https://github.com/metabase/metabase/security/advisories/GHSA-vm79-xvmp-7329"
            },
            {
              "name": "https://www.sqlite.org/lang_attach.html",
              "refsource": "MISC",
              "url": "https://www.sqlite.org/lang_attach.html"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-vm79-xvmp-7329",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24854",
    "datePublished": "2022-04-14T21:40:11",
    "dateReserved": "2022-02-10T00:00:00",
    "dateUpdated": "2024-08-03T04:20:50.469Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-24854\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-04-14T22:15:08.110\",\"lastModified\":\"2022-04-22T16:21:38.903\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file path to the second database. Users are advised to upgrade as soon as possible. If you\u0027re unable to upgrade, you can modify your SQLIte connection strings to contain the url argument `?limit_attached=0`, which will disallow making connections to other SQLite databases. Only users making use of SQLite are affected.\"},{\"lang\":\"es\",\"value\":\"Metabase es una aplicaci\u00f3n de an\u00e1lisis e inteligencia empresarial de c\u00f3digo abierto. SQLite presenta una caracter\u00edstica similar a FDW llamada \\\"ATTACH DATABASE\\\", que permite conectar m\u00faltiples bases de datos SQLite por medio de la conexi\u00f3n inicial. Si el atacante presenta permisos de SQL en al menos una base de datos SQLite, entonces puede adjuntar esta base de datos a una segunda base de datos, y entonces puede consultar todas las tablas. Para poder hacer esto, el atacante tambi\u00e9n necesita conocer la ruta del archivo de la segunda base de datos. Es recomendado a usuarios actualizar lo antes posible. Si no puedes actualizar, puedes modificar tus cadenas de conexi\u00f3n SQLIte para que contengan el argumento url \\\"?limit_attached=0\\\", que deshabilitar\u00e1 la realizaci\u00f3n de conexiones a otras bases de datos SQLite. S\u00f3lo estar\u00e1n afectados los usuarios que usen SQLite\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.0,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":6.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":6.5},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-610\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.41.0\",\"versionEndExcluding\":\"0.41.7\",\"matchCriteriaId\":\"548FFDC4-010F-4B2C-995F-41F540995B0E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.42.0\",\"versionEndExcluding\":\"0.42.4\",\"matchCriteriaId\":\"F9282AB8-E8AF-4431-9BED-D1427CDF81BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.41.0\",\"versionEndExcluding\":\"1.41.7\",\"matchCriteriaId\":\"4E19CC33-86D1-42B3-8EBC-3642FF59A5AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.42.0\",\"versionEndExcluding\":\"1.42.4\",\"matchCriteriaId\":\"0661FFDD-F667-4818-8EB3-B42E9E7001F2\"}]}]}],\"references\":[{\"url\":\"https://github.com/metabase/metabase/security/advisories/GHSA-vm79-xvmp-7329\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://www.sqlite.org/lang_attach.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}