Lucene search

[email protected]CVE-2021-41277

HistoryNov 17, 2021 - 8:15 p.m.

CVE-2021-41277

2021-11-1720:15:10

CWE-200

CWE-22

[email protected]

web.nvd.nist.gov

metabase

security

cve

2021

41277

data analytics

geojson

local file inclusion

upgrade

mitigation

reverse proxy

load balancer

waf

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

7 High

AI Score

Confidence

High

0.954 High

EPSS

Percentile

99.4%

JSON

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (admin->settings->maps->custom maps->add a map) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

Affected configurations

Vulners

NVD

Node

metabasemetabaseRange<0.40.5

metabasemetabaseRange1.0.0–1.40.5

VendorProductVersionCPE
metabasemetabase*cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
metabasemetabase*cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
metabase	metabase	*	cpe:2.3:a:metabase:metabase::::::::
metabase	metabase	*	cpe:2.3:a:metabase:metabase::::::::

CNA Affected

[
  {
    "product": "metabase",
    "vendor": "metabase",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.40.5"
      },
      {
        "status": "affected",
        "version": ">= 1.0.0, < 1.40.5"
      }
    ]
  }
]