Project
Metabase is an open-source business intelligence tool that lets organizations query databases and build dashboards, also offered as a hosted Cloud service.
Double Counter says an attacker entered through a retired OVH server running Metabase and spent 5 h 51 min in its cloud. Two credentials stored on that host gave the intruder administrator access to the operator's cloud.
Reality
JPCERT/CC says attackers abused mobile-app APIs and exploited a known Metabase flaw in a leak run Macnica puts at 119 Japanese incidents this year. Some leaks came from BI tools and staff systems their owners never expected outsiders to reach, so the alert asks for access control on every endpoint, public or not.
Reality
A fulfillment partner exposed names, addresses and phone numbers belonging to hardware wallet buyers, according to The Register. The vendor's boundary was the company's boundary.
Perspective Coverage
3 publishersReality
Three exploited flaws, three very different exposure classes. The self-hosted Metabase zero-day is the one with an unpatched population behind it.
Reality
The records cover orders placed between November 2019 and August 2021, years past the 90-day deletion window Trezor advertises. Trezor says it held repeated written confirmation from ShipMonk that the data was gone.
Perspective Coverage
3 publishersReality
Metabase published a critical fix on August 6, Mathspace's escalation process never surfaced it, and by the time the update went in on August 29 an intruder had been inside the reporting instance for 19 days and had already exported 1,079,819 records.
Perspective Coverage
4 publishersReality
Brevo says an intruder reached 120 customer accounts and used them to mail phishing from those customers' own domains. Three crypto companies confirmed their newsletter lists were hit. Only one named the provider.
Perspective Coverage
4 publishersReality
Administrator access on Mathspace's self-hosted reporting tool needed no login, and the week's other exposures sat in an unclaimed Elasticsearch cluster and inside an AI provider's shared package cache.
Reality