322 matches found
CVE-2022-24853 File system exposure in Metabase
Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result ...
CVE-2022-24853
CVE-2022-24853 affects Metabase (GeoJSON support via a URL-loading proxy). The issue arises from a proxy that loads arbitrary URLs for JSON maps; while validation prevents returning arbitrary URL contents, a crafted request can trigger file access on Windows, enabling an NTLM relay attack and pot...
CVE-2022-24853 File system exposure in Metabase
Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result ...
CVE-2022-24854 Database bypassing any permissions in Metabase via SQlite attach
Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...
CVE-2022-24854 Database bypassing any permissions in Metabase via SQlite attach
Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...
CVE-2022-24854
Summary of CVE-2022-24854 (Metabase) : Metabase uses SQLite with an FDW-like feature called ATTACH DATABASE. If an attacker has SQL permissions on at least one SQLite database, they can attach that database to a second one and query across all attached tables. Exploitation requires knowledge of t...
CVE-2022-24854 Database bypassing any permissions in Metabase via SQlite attach
Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...
CVE-2022-24855 XSS vulnerability in Metabase
Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...
CVE-2022-24855 XSS vulnerability in Metabase
Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...
CVE-2022-24855
CVE-2022-24855 (Metabase) affects Metabase versions prior to the patched releases. The vulnerability arises from an internal development endpoint “/_internal” that can be exploited to perform cross-site scripting (XSS), potentially enabling phishing with malicious links and account takeover. Affe...
CVE-2022-24855 XSS vulnerability in Metabase
Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...
Metabase 跨站脚本漏洞
Metabase is an open source data analytics platform from Metabase, Inc. A cross-site scripting vulnerability exists in Metabase, which originates from an internal development endpoint that could allow cross-site scripting XSS attacks. The following products and versions are affected: x.42 - x.42.3...
Metabase 信息泄露漏洞
Metabase is an open source data analytics platform from US-based Metabase, Inc. Metabase suffers from an information disclosure vulnerability that stems from having a proxy that is used to load JSON-mapped arbitrary URLs as part of our GeoJSON support. While we perform validation to not return th...
Metabase 安全漏洞
Metabase is an open source data analytics platform from Metabase, Inc. in the United States. Metabase suffers from a security vulnerability that stems from the fact that SQLite has an FDW-like feature called ATTACH DATABASE that allows multiple SQLite databases to be connected via an initial join...
Metabase GeoJSON Map Information Disclosure (CVE-2021-41277)
An information disclosure vulnerability exists in Metabase GeoJSON Map. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase
CVE-2021-41277 MetaBase Arbitrary File Reading This is a...
Metabase GeoJSON Local File Inclusion
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables because URLs were not validated prior to...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase
CVE-2021-41277 Metabase GeoJSON map local fil...