CyberSecBulletin

Openmetadata vulnerabilities

We track 5 vulnerabilities in Openmetadata products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on March 15, 2024.

5vulnerabilities
1critical
4high
0exploited
9.0average CVSS score

Latest Openmetadata vulnerabilities

  • 8.8 High severity

    OpenMetadata: Improper Control of Generation of Code

    CVE-2024-28848Open-metadataEPSS 7.89%

    OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `‎CompiledRule::validateExpression` method evaluates an SpEL expression using an `S

  • 8.8 High severity

    OpenMetadata: Improper Control of Generation of Code

    CVE-2024-28847Open-metadataEPSS 2.37%

    OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, `AlertUtil::validateExpression` is also called fr

  • 9.8 Critical severity

    OpenMetadata: Improper Authentication

    CVE-2024-28255Open-metadataEPSS 73.3%

    OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. W

  • 8.8 High severity

    OpenMetadata: Improper Neutralization of Special Elements used in an OS Command

    CVE-2024-28254Open-metadataEPSS 45.7%

    OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `‎AlertUtil::validateExpression` method evaluates an SpEL expression using `getValu

  • 8.8 High severity

    OpenMetadata: Improper Control of Generation of Code

    CVE-2024-28253Open-metadataEPSS 12.5%

    OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `pre