UpHeron
All vulnerabilities

Servers and applications

CVE-2022-24854

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do…

Severity
High 8.8
Published
14 Apr 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
0.41.7, 0.42.4, 1.41.7, 1.42.4
Sources
NVD

Affected software

SoftwareAffected versions
MetabaseServers and applications · cpe:a:metabase:metabase
  • From 0.41.0 before 0.41.7
  • From 0.42.0 before 0.42.4
  • From 1.41.0 before 1.41.7
  • From 1.42.0 before 1.42.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-24854
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-24854