CVE-2021-41277

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Oct 8, 2026

Description

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Nov 17, 2021
Last modified
Oct 8, 2026
Added to CISA KEV
Nov 12, 2024
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-412785.7Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting daCVE-2021-412798.8BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload priviCVE-2021-41286.5When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentCVE-2021-412809.8Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installatioCVE-2021-412817.5Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repositorCVE-2021-412828.8diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set inCVE-2021-412857.8Ballistix MOD Utility through 2.0.2.5 is vulnerable to privilege escalation in the MODAPI.sys driver component. The vulnerability is triggerCVE-2021-412867.8Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. When a user logs into the application, the validityCVE-2021-412889.8Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.CVE-2021-412896.3ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. With a general user’s permisCVE-2021-41299.8Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano rCVE-2021-412909.8ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attack