TLDR Tech / InfoSec
Metabase SQLi Zero-Day Exploited in Customer Data-Theft Attacks
Metabase disclosed a critical zero-day vulnerability that is being actively exploited by attackers. The vulnerability is a critical, unauthenticated SQL injection bug that can allow remote attackers to gain administrative access to target instances. Cloud users have already been patched, but self-hosted organizations should upgrade to a patched release or temporarily block access to the ‘/api/session/reset_password/‘ endpoint until updates can be applied.
Read the full story