tag: Metabase · 2 items
- Engineer — Learn: Metabase is globally deployed and has a history of critical exploited CVEs; this JPCERT alert suggests active exploitation of known Metabase flaws. Audit Metabase instances for current patch level and review mobile API authentication controls, but no enrichment signals or specific CVEs are named to trigger urgent action.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Metabase is widely self-hosted as an internal analytics/BI tool; audit your own Metabase instance for misconfigurations or unpatched CVEs that may match the attack vector used here, and verify network exposure of the service.
- SOC/IR — Skip
- Leader — Learn: A 1M+ record breach via an internal BI tool (Metabase) at an ed-tech vendor illustrates third-party analytics platform risk, but requires no immediate leadership action for organizations not using Mathspace.