Description
OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open-metadata | OpenMetadata | < 1.11.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.open-metadata:platform | >= 1.5.0, < 1.11.4 | 1.11.4 | GHSA-5f29-2333-h9c7 |