CVE-2025-30371CWE-59

Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Low · published March 28, 2025

CVSS v4.0
2.1
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2025-03-28T14:47Z
EPSS history
Timeline
  • 28 MAR 14:47Z
    Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
    cvelistv5