CVE-2021-41277

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-41277
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41277.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-41277
Related
  • GHSA-w73v-6p7p-fpfr
Published
2021-11-17T20:15:10.587Z
Modified
2026-04-10T04:38:27.307222Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (admin->settings->maps->custom maps->add a map) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

References

Affected packages

Git / github.com/metabase/metabase

Affected ranges

Type
GIT
Repo
https://github.com/metabase/metabase
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
961caedc9983dfef7e25dfdfb0e18c9bde02dca4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ed8f9c8d89bbb422ddfb3ec306f67c4dfa85a7f3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b884d29b3d0f8bdcdc9bd7f0f780bc95f13033e4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c82665c6693c39891017232caadcea6e38bf310d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
16d2e53436c3535e7040035bb23c4c3b2ddb9b79
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
961caedc9983dfef7e25dfdfb0e18c9bde02dca4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ed8f9c8d89bbb422ddfb3ec306f67c4dfa85a7f3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b884d29b3d0f8bdcdc9bd7f0f780bc95f13033e4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c82665c6693c39891017232caadcea6e38bf310d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
16d2e53436c3535e7040035bb23c4c3b2ddb9b79
Fixed
042a36e49574c749f944e19cf80360fd3dc322f0
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.40.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.40.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.40.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.40.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.40.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.40.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.40.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.40.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.40.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.40.4"
        }
    ]
}

Affected versions

0.*
0.10.3
0.34.0-rc1
Other
blah
v20150601-alpha
v20150603-alpha
v20150604-alpha
v0.*
v0.10.0
v0.10.3
v0.10.4
v0.10.4.1
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.12.0
v0.12.0-test
v0.13.0
v0.26.0.RC1
v0.35.0
v0.35.0-rc1
v0.35.0-rc2
v0.36.0-snapshot
v0.37.0-rc2
v0.38.0-preview
v0.38.0-rc1
v0.38.0-rc2
v0.38.0-rc3
v0.38.0-rc4
v0.40.0
v0.40.0-rc1-dan
v0.40.0-rc2
v0.40.1
v0.40.2
v0.40.3
v0.40.3.1
v0.40.4
v0.9-final
v1.*
v1.40.0
v1.40.0-rc2
v1.40.1
v1.40.2
v1.40.3
v1.40.3.1
v1.40.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41277.json"