[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIjDMNsekxzhU-zGRYjZXN3hEamkmWrhvRKRtsXqxV0U":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":18,"kevVulnerabilities":78,"topProductsByCves":84,"seoMetadata":86,"meta":95},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":9,"versionCount":11,"lastCveUpdate":12,"firstLetter":13,"products":14,"description":17},19538,"metabase",1,17,1868,"2025-02-24","m",[15],{"id":16,"product_name":8,"version_count":11,"cve_count":10,"kev_count":9,"last_cve_update":12},108480,"Metabase is a technology vendor with 1 tracked product and 17 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[19,28,34,41,46,53,57,61,68,73],{"cveId":20,"description":21,"publishedDate":22,"cvssScore":23,"cvssVersion":24,"severity":25,"isKev":26,"epssScore":27},"CVE-2023-38646","Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.","2023-07-21",9.8,"v3.1","Critical",false,0.98677,{"cveId":29,"description":30,"publishedDate":31,"cvssScore":32,"cvssVersion":24,"severity":25,"isKev":4,"epssScore":33},"CVE-2021-41277","Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.","2021-11-17",10,0.97178,{"cveId":35,"description":36,"publishedDate":37,"cvssScore":38,"cvssVersion":24,"severity":39,"isKev":26,"epssScore":40},"CVE-2022-24853","Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.","2022-04-14",5.3,"Medium",0.02524,{"cveId":42,"description":43,"publishedDate":44,"cvssScore":23,"cvssVersion":24,"severity":25,"isKev":26,"epssScore":45},"CVE-2023-37470","Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, a vulnerability could potentially allow remote code execution on one's Metabase server. The core issue is that one of the supported data warehouses (an embedded in-memory database H2), exposes a number of ways for a connection string to include code that is then executed by the process running the embedded database. Because Metabase allows users to connect to databases, this means that a user supplied string can be used to inject executable code. Metabase allows users to validate their connection string before adding a database (including on setup), and this validation API was the primary vector used as it can be called without validation. Versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4 fix this issue by removing the ability of users to add H2 databases entirely. As a workaround, it is possible to block these vulnerabilities at the network level by blocking the endpoints `POST \u002Fapi\u002Fdatabase`, `PUT \u002Fapi\u002Fdatabase\u002F:id`, and `POST \u002Fapi\u002Fsetup\u002Fvalidateuntil`. Those who use H2 as a file-based database should migrate to SQLite.","2023-08-04",0.01349,{"cveId":47,"description":48,"publishedDate":49,"cvssScore":50,"cvssVersion":24,"severity":51,"isKev":26,"epssScore":52},"CVE-2022-39361","Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL statements in H2 native queries.","2022-10-26",8.8,"High",0.01075,{"cveId":54,"description":55,"publishedDate":37,"cvssScore":50,"cvssVersion":24,"severity":51,"isKev":26,"epssScore":56},"CVE-2022-24854","Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file path to the second database. Users are advised to upgrade as soon as possible. If you're unable to upgrade, you can modify your SQLIte connection strings to contain the url argument `?limit_attached=0`, which will disallow making connections to other SQLite databases. Only users making use of SQLite are affected.",0.01053,{"cveId":58,"description":59,"publishedDate":49,"cvssScore":50,"cvssVersion":24,"severity":51,"isKev":26,"epssScore":60},"CVE-2022-39362","Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor shows the query and gives the user the option to manually run the query if they want.",0.00881,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"cvssVersion":66,"severity":39,"isKev":26,"epssScore":67},"CVE-2018-0697","Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","2018-11-15",6.1,"v3.0",0.00842,{"cveId":69,"description":70,"publishedDate":49,"cvssScore":71,"cvssVersion":24,"severity":39,"isKev":26,"epssScore":72},"CVE-2022-43776","The url parameter of the \u002Fapi\u002Fgeojson endpoint in Metabase versions \u003C44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects.",6.5,0.00713,{"cveId":74,"description":75,"publishedDate":37,"cvssScore":76,"cvssVersion":24,"severity":39,"isKev":26,"epssScore":77},"CVE-2022-24855","Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `\u002F_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall to `\u002F_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.",5.4,0.00712,[79],{"cveId":29,"description":30,"publishedDate":31,"cvssScore":32,"cvssVersion":24,"severity":25,"isKev":4,"epssScore":33,"cisaVulnName":80,"cisaDateAdded":81,"cisaShortDescription":82,"cisaRequiredAction":83},"Metabase GeoJSON API Local File Inclusion Vulnerability","2024-11-12","Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",[85],{"id":16,"product_name":8,"version_count":11,"cve_count":10,"kev_count":9,"last_cve_update":12},{"title":87,"metaDescription":88,"keywords":89,"structuredData":90},"Metabase - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Metabase covering 1 product with 17 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Metabase vulnerabilities, Metabase security, Metabase CVE, Metabase threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Metabase KEV, Metabase exploited vulnerabilities",{"@context":91,"@type":92,"name":93,"description":88,"url":94},"https:\u002F\u002Fschema.org","Organization","Metabase","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fmetabase",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":9,"lastUpdated":12,"generatedAt":96,"apiVersion":97},"2026-10-18T11:34:07.457Z","3.0"]