Description

Acunetix determined that it was possible to access Metabase's sensitive files without authentication.

Remediation

Upgrade to the latest version of Metabase

References

GeoJSON URL validation can expose server files and environment variables to unauthorized users

Related Vulnerabilities

Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-2890)

WeBid Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3815)

Typo3 Admin publicly accessible

WordPress 5.6.x Multiple Vulnerabilities (5.6 - 5.6.4)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-1829)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

File Inclusion CWE-200 CVE-2021-41277