CVE-2023-38646
First published: Fri Jul 21 2023(Updated: )
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Metabase | <0.43.7.2 | |
| Metabase | <1.43.7.2 | |
| Metabase | >=0.44.0<0.44.7.1 | |
| Metabase | >=0.45.0<0.45.4.1 | |
| Metabase | >=0.46.0<0.46.6.1 | |
| Metabase | >=1.44.0<1.44.7.1 | |
| Metabase | >=1.45.0<1.45.4.1 | |
| Metabase | >=1.46.0<1.46.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://news.ycombinator.com/item?id=36812256
- https://github.com/metabase/metabase/releases/tag/v0.46.6.1
- https://www.metabase.com/blog/security-advisory
- https://github.com/metabase/metabase/issues/32552
- http://packetstormsecurity.com/files/174091/Metabase-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Execution.html
Frequently Asked Questions
What is the vulnerability ID for this Metabase vulnerability?
The vulnerability ID for this Metabase vulnerability is CVE-2023-38646.
What is the severity of CVE-2023-38646?
The severity of CVE-2023-38646 is critical with a severity value of 9.8.
How can attackers exploit CVE-2023-38646?
Attackers can exploit CVE-2023-38646 to execute arbitrary commands on the server, at the server's privilege level without requiring authentication.
What software versions are affected by CVE-2023-38646?
Metabase open source versions before 0.46.6.1 and Metabase Enterprise versions before 1.46.6.1 are affected by CVE-2023-38646.
How can I fix CVE-2023-38646?
To fix CVE-2023-38646, you should update your Metabase installation to version 0.46.6.1 for open source or 1.46.6.1 for Metabase Enterprise.
- collector/nvd-latest
- agent/author
- agent/type
- agent/softwarecombine
- agent/references
- agent/severity
- agent/first-publish-date
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/metabase
- canonical/metabase
- version/metabase/0.44.0
- version/metabase/0.45.0
- version/metabase/0.46.0
- version/metabase/1.44.0
- version/metabase/1.45.0
- version/metabase/1.46.0