Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.
| Vendor | Product | Versions |
|---|---|---|
| metaba | metaba | x.58.0, x.59.0, x.60.0, x.61.0, x.62.0, x.63.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| metaba | metabase | cert_advisory | 90% |
