CVE-2021-41277: metabase

csirt@kutim:~/threat-intel/cve/CVE-2021-41277

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 97,2%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada metabase. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 12 November 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

Rincian

Terbit di NVD: 17 November 2021
Terakhir diubah: 8 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 97,2% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Metabase GeoJSON API Local File Inclusion Vulnerability
Masuk KEV: 12 November 2024
Tenggat CISA: 3 Desember 2024 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
metabase	metabase	Versi 0.40.0
metabase	metabase	Versi 0.40.1
metabase	metabase	Versi 0.40.2
metabase	metabase	Versi 0.40.3
metabase	metabase	Versi 0.40.4
metabase	metabase	Versi 1.40.0
metabase	metabase	Versi 1.40.1
metabase	metabase	Versi 1.40.2
metabase	metabase	Versi 1.40.3
metabase	metabase	Versi 1.40.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0 patch
https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr mitigasi · advisory pihak ketiga
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41277 pemerintah AS

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 00:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.