Description (CNA)
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| metabase / metabase | affected < 0.41.9; affected >= 0.42.0, < 0.42.6; affected >= 0.43.0, < 0.43.7; affected >= 0.44.0, < 0.44.5; affected >= 1.0.0, < 1.41.9; affected >= 1.42.0, < 1.42.6; affected >= 1.43.0, < 1.43.7; affected >= 1.44.0, < 1.44.5 |
CWE
CWE-200
References
- https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4
- https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.