Medium severity · published Dec 16, 2024
CVE-2024-55951
Metabase sandboxed users could see filter values from other sandboxed users
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There are no workarounds for this issue aside from upgrading.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
metabase · metabase
>= 1.52.0, < 1.52.2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-55951
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-55951
downloads.metabase.com
https://downloads.metabase.com/v0.52.2.5/metabase.jar
github.com
https://github.com/metabase/metabase/security/advisories/GHSA-rhjf-q2qw-rvx3
hub.docker.com
https://hub.docker.com/r/metabase/metabase/tags
More from metabase
10.0
CVE-2026-72898
Metabase SQL injection via password reset endpoint
7.5
CVE-2021-41277
GeoJSON URL validation can expose server files and environment variables to unauthorized users
10.0
CVE-2026-72899
Metabase SQL injection via public card or dashboard
9.8
CVE-2023-37470
Metabase is an open-source business intelligence and analytics platform
9.8
CVE-2023-38646
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level