Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
| Vendor | Product | Versions |
|---|---|---|
| metaba | metabase | x.58.0, x.59.0, x.60.0, x.61.0, x.62.0, x.63.0 |
