CVE-2021-41277: metabase 0.40.0, 0.40.1, 0.40.2 (+7 more affected versions)

Affected technology

metabase · 0.40.0
metabase

metabase · 0.40.1
metabase

metabase · 0.40.2
metabase

metabase · 0.40.3
metabase

metabase · 0.40.4
metabase

metabase · 1.40.0
metabase

metabase · 1.40.1
metabase

metabase · 1.40.2
metabase

metabase · 1.40.3
metabase

metabase · 1.40.4
metabase

metabase · < 0.40.5, >= 1.0.0, < 1.40.5
metabase

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 10.0/10) rates confidentiality and integrity impact as high; availability impact as low. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.