CVE-2022-39360 : What You Need to Know
Learn about CVE-2022-39360, a Metabase vulnerability letting SSO users reset passwords to bypass IdP login. Find mitigation steps and affected versions.
This article provides an overview of CVE-2022-39360, a vulnerability in Metabase that allowed SSO users to circumvent IdP login by doing password reset.
Understanding CVE-2022-39360
Metabase users prior to certain versions could reset their passwords, bypassing the SSO IdP login. This issue is resolved in newer versions that no longer allow password resets for SSO users.
What is CVE-2022-39360?
Metabase versions prior to 0.41.9, 0.42.6, 0.43.7, and 0.44.5 had a vulnerability where SSO users could reset their passwords, gaining unauthorized access.
The Impact of CVE-2022-39360
The vulnerability in CVE-2022-39360 allowed unauthorized users to access Metabase by resetting their passwords, bypassing SSO authentication.
Technical Details of CVE-2022-39360
This section covers the vulnerability description, affected systems and versions, and the exploitation mechanism.
Vulnerability Description
Prior to versions 0.41.9, 0.42.6, 0.43.7, and 0.44.5 of Metabase, SSO users could reset their passwords, potentially gaining unauthorized access.
Affected Systems and Versions
Metabase versions including < 0.41.9, >= 0.42.0, < 0.42.6, >= 0.43.0, < 0.43.7, and >= 0.44.0, < 0.44.5 were impacted by this vulnerability.
Exploitation Mechanism
Users could exploit this vulnerability by resetting their passwords, allowing them to bypass SSO authentication and gain unauthorized access.
Mitigation and Prevention
To mitigate the risks associated with CVE-2022-39360, users should take immediate steps and follow long-term security practices.
Immediate Steps to Take
Update Metabase to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, or 1.41.9 to patch the vulnerability and prevent unauthorized access.
Long-Term Security Practices
Implement strict password reset policies, enforce regular security updates, and monitor user authentication to enhance overall system security.
Patching and Updates
Regularly check for security advisories and updates from Metabase to stay informed about potential vulnerabilities and apply patches promptly.