Design/Logic Flaw

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

CVE-2022-43776

The url parameter of the /api/geojson endpoint in Metabase versions 44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects...

CVE-2022-43776

The url parameter of the /api/geojson endpoint in Metabase versions 44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects...

Metabase 输入验证错误漏洞

Metabase is an open source data analytics platform from the US-based Metabase, Inc. A security vulnerability exists in Metabase that stems from a custom GeoJSON map URL address that will follow a redirect to an address that is otherwise not allowed, such as a link to a local or private network...

Metabase 代码问题漏洞

Metabase is an open source data analytics platform from the US-based Metabase Inc. A security vulnerability exists in Metabase versions prior to 44.5, which stems from the /api/geojson endpoint's url parameter can be used to perform a server-side request forgery attack that utilizes 301 and 302...

CVE-2022-39359 Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

PT-2022-27030 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 44.5 Description: The issue concerns the url parameter of the "/api/geojson" endpoint, which can be exploited to perform Server Side Request Forgery attacks. It is noted that previously implemented blacklists could ...

PT-2022-24927 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 Description: The issue concerns Metabase, a data visualization software. In affected versions, a custom GeoJSON map URL address would follow redirec...

CVE-2022-39359 Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

CVE-2022-43776

CVE-2022-43776 affects Metabase versions prior to 44.5, where the url parameter of the /api/geojson endpoint can be abused to perform a Server Side Request Forgery (SSRF). The issue can be exploited by bypassing blacklists using 301/302 redirects. Impact described in sources indicates exposure to...

VulnCheck KEV: CVE-2021-41277

Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data...

CVE-2022-24853

CVE-2022-24853 affects Metabase (GeoJSON support via a URL-loading proxy). The issue arises from a proxy that loads arbitrary URLs for JSON maps; while validation prevents returning arbitrary URL contents, a crafted request can trigger file access on Windows, enabling an NTLM relay attack and pot...

Metabase 信息泄露漏洞

Metabase is an open source data analytics platform from US-based Metabase, Inc. Metabase suffers from an information disclosure vulnerability that stems from having a proxy that is used to load JSON-mapped arbitrary URLs as part of our GeoJSON support. While we perform validation to not return th...

Metabase GeoJSON Map Information Disclosure (CVE-2021-41277)

An information disclosure vulnerability exists in Metabase GeoJSON Map. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...

Metabase GeoJSON Local File Inclusion

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables because URLs were not validated prior to...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase

CVE-2021-41277 Metabase GeoJSON map local fil...

CVE-2021-41277

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...

CVE-2021-41277

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...

Design/Logic Flaw

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...

CVE-2021-41277 GeoJSON URL validation can expose server files and environment variables to unauthorized users

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...