CVE-2022-24854

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...

CVE-2022-24853

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result ...

Design/Logic Flaw

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...

Input validation

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result ...

Cross site scripting

Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...

CVE-2022-24853 File system exposure in Metabase

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result ...

CVE-2022-24853 File system exposure in Metabase

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result ...

CVE-2022-24853

CVE-2022-24853 affects Metabase (GeoJSON support via a URL-loading proxy). The issue arises from a proxy that loads arbitrary URLs for JSON maps; while validation prevents returning arbitrary URL contents, a crafted request can trigger file access on Windows, enabling an NTLM relay attack and pot...

CVE-2022-24853 File system exposure in Metabase

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result ...

CVE-2022-24854 Database bypassing any permissions in Metabase via SQlite attach

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...

CVE-2022-24854 Database bypassing any permissions in Metabase via SQlite attach

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...

CVE-2022-24854 Database bypassing any permissions in Metabase via SQlite attach

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...

CVE-2022-24854

Summary of CVE-2022-24854 (Metabase) : Metabase uses SQLite with an FDW-like feature called ATTACH DATABASE. If an attacker has SQL permissions on at least one SQLite database, they can attach that database to a second one and query across all attached tables. Exploitation requires knowledge of t...

CVE-2022-24855

CVE-2022-24855 (Metabase) affects Metabase versions prior to the patched releases. The vulnerability arises from an internal development endpoint “/_internal” that can be exploited to perform cross-site scripting (XSS), potentially enabling phishing with malicious links and account takeover. Affe...

CVE-2022-24855 XSS vulnerability in Metabase

Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...

CVE-2022-24855 XSS vulnerability in Metabase

Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...

CVE-2022-24855 XSS vulnerability in Metabase

Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...

CVE-2022-24854: Externally Controlled Reference to a Resource in Another Sphere

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...

CVE-2022-24855: Improper Neutralization of Input During Web Page Generation

Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...

Metabase 安全漏洞

Metabase is an open source data analytics platform from Metabase, Inc. in the United States. Metabase suffers from a security vulnerability that stems from the fact that SQLite has an FDW-like feature called ATTACH DATABASE that allows multiple SQLite databases to be connected via an initial join...