CVE-2021-41277

Metabase GeoJSON API Local File Inclusion Vulnerability

Metabase

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate…

17. Nov 2021

Ausgewertete Quellen

• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41277
• CISA
  Metabase GeoJSON API Local File Inclusion Vulnerability
• NVD
  CVE-2021-41277
• GitHub
  https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr