Browsing: Metabase

Framework, the San Francisco-based company that designs repairable and upgradeable laptops, has suffered a data breach after attackers managed to exploit a zero-day vulnerability in the Metabase business intelligence service.

Framework reports a Framework data breach at business intelligence provider Metabase that exposed customer contact data. The company shared the notice on the Framework Community. Framework says payment and order records stay out of the accessed set. Metabase also published a security update about a zero-day on Metabase Cloud.

Metabase just confirmed something no analytics vendor wants to write: attackers found and used an unpatched, maximum-severity flaw against Metabase Cloud before anyone on the defense side knew it existed. The company’s own advisory says the vulnerability carries a CVSS score of 10.0, and it let an unauthenticated attacker inject arbitrary SQL straight into the…