Description (CNA)
OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| open-metadata / OpenMetadata | affected < 1.11.4 |
CWE
CWE-1336
References
- https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7
- https://github.com/open-metadata/OpenMetadata/commit/bffe7c45807763f9b682021d4211c478d2a08bb3
- https://github.com/open-metadata/OpenMetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108
ADP enrichment
No English description supplied.