Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Summary

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain

News Radar provides aggregated summaries. Full content and copyright remain with the original publisher.