description: The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects.
problem types: Server Side Request Forgery (SSRF)
affected:
{
vendor: n/a
product: Metabase
versions:
version: <44.5, status: affected
}