Metabase patches exploited SQL injection after Framework and Tally report data theft
The unauthenticated SQL injection flaw gave attackers a path from an analytics instance to connected database credentials and customer records.
By Ryan Merket · Published
Primary source: BleepingComputer
Why it matters
Metabase can hold the credentials and permissions needed to query connected databases, so one unauthenticated flaw turned an analytics tool into a route to customer records.
Sameer Al-Sakran, founder and CEO of Metabase, disclosed on August 6th that an attacker had used a previously unknown vulnerability against Metabase Cloud, forcing Metabase to block the affected endpoints and patch customer instances. BleepingComputer reported on August 7th that laptop maker Framework and form builder Tally had confirmed data theft from their Metabase environments.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.