Metabase Information Disclosure Vulnerability

Metabase is an open source data analysis platform from Metabase, Inc. An information disclosure vulnerability exists in Metabase, which stems from a lack of permission validation in the product's admin-settings-maps-custom maps-add a map operation. An attacker could obtain sensitive information...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase

CVE-2021-41277 PoC Metabase is an open source data analytics...

CVE-2021-41277

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...

CVE-2021-41277

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...

Design/Logic Flaw

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...

CVE-2021-41277 GeoJSON URL validation can expose server files and environment variables to unauthorized users

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...

CVE-2021-41277

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map "admin-settings-maps-custom maps-add a map" support and potential local file inclusion including environment variables. URLs were not validated prior to being...

CVE-2021-41277

Metabase GeoJSON API Local File Inclusion vulnerability (CVE-2021-41277) affects Metabase prior to version 0.40.5/1.40.5, via the custom GeoJSON map feature where URLs were not validated before loading, enabling local file access (including environment variables). Impact described as local file i...

CVE-2021-41277 GeoJSON URL validation can expose server files and environment variables to unauthorized users

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...

PT-2021-23236

Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.40.5 Metabase versions prior to 1.40.5 Description A security issue has been discovered in Metabase, an open source data analytics platform, related to the custom GeoJSON map support and potential local file...

CVE-2021-41277

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...

Metabase 路径遍历漏洞

Metabase is an open source data analysis platform from Metabase, Inc. An information disclosure vulnerability exists in Metabase, which stems from a lack of permission validation in the product's admin-settings-maps-custom maps-add a map operation. An attacker could obtain sensitive information...

CVE-2021-41277: Exposure of Sensitive Information to an Unauthorized Actor

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not validated prior to being...

PT-2020-21810

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ, with details provided in a crash state. The crash state includes information about std:: 1:: MetaBase...

PT-2020-22566

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a crash type of UNKNOWN READ, with details provided in a crash state. The crash state includes information about std:: 1:: MetaBas...

CVE-2018-0697

Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0697

Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0697

Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0697

Metabase is affected by a cross-site scripting vulnerability (CWE-79) in version 0.29.3 and earlier. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, potentially affecting a logged-in user’s browser session. Public details across multiple s...