CVE-2021-41277

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-41277
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41277.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-41277
Aliases
  • GHSA-w73v-6p7p-fpfr
Published
2021-11-17T20:15:10.587Z
Modified
2026-07-09T10:01:37.508604Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (admin->settings->maps->custom maps->add a map) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

References

Affected packages

Git / github.com/metabase/metabase

Affected ranges

Type
GIT
Repo
https://github.com/metabase/metabase
Events
Introduced
961caedc9983dfef7e25dfdfb0e18c9bde02dca4
Last affected
16d2e53436c3535e7040035bb23c4c3b2ddb9b79
Fixed
042a36e49574c749f944e19cf80360fd3dc322f0
Database specific 
{
    "cpe": [
        "cpe:2.3:a:metabase:metabase:0.40.0:-:*:*:-:*:*:*",
        "cpe:2.3:a:metabase:metabase:1.40.0:-:*:*:enterprise:*:*:*",
        "cpe:2.3:a:metabase:metabase:0.40.1:*:*:*:-:*:*:*",
        "cpe:2.3:a:metabase:metabase:1.40.1:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:metabase:metabase:0.40.2:*:*:*:-:*:*:*",
        "cpe:2.3:a:metabase:metabase:1.40.2:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:metabase:metabase:0.40.3:*:*:*:-:*:*:*",
        "cpe:2.3:a:metabase:metabase:1.40.3:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:metabase:metabase:0.40.4:*:*:*:-:*:*:*",
        "cpe:2.3:a:metabase:metabase:1.40.4:*:*:*:enterprise:*:*:*"
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.40.0-NA"
        },
        {
            "last_affected": "0.40.0-NA"
        },
        {
            "introduced": "1.40.0-NA"
        },
        {
            "last_affected": "1.40.0-NA"
        },
        {
            "introduced": "0.40.1"
        },
        {
            "last_affected": "0.40.1"
        },
        {
            "introduced": "1.40.1"
        },
        {
            "last_affected": "1.40.1"
        },
        {
            "introduced": "0.40.2"
        },
        {
            "last_affected": "0.40.2"
        },
        {
            "introduced": "1.40.2"
        },
        {
            "last_affected": "1.40.2"
        },
        {
            "introduced": "0.40.3"
        },
        {
            "last_affected": "0.40.3"
        },
        {
            "introduced": "1.40.3"
        },
        {
            "last_affected": "1.40.3"
        },
        {
            "introduced": "0.40.4"
        },
        {
            "last_affected": "0.40.4"
        },
        {
            "introduced": "1.40.4"
        },
        {
            "last_affected": "1.40.4"
        }
    ]
}

Affected versions

0.*
0.40.0-NA
0.40.1
0.40.2
0.40.3
0.40.4
v0.*
v0.40.0
v0.40.1
v0.40.2
v0.40.3
v0.40.3.1
v0.40.4
v1.*
v1.40.0
v1.40.1
v1.40.2
v1.40.3
v1.40.3.1
v1.40.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41277.json"