CVE-2023-38646
critical · 9.8A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.
9.8
CVSS
98.7%
EPSS (exploit prob.)
100th
EPSS percentile
2023-07-21
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| metabase | metabase | < 0.43.7.2 |
| metabase | metabase | < 1.43.7.2 |
| metabase | metabase | >= 0.44.0, < 0.44.7.1 |
| metabase | metabase | >= 0.45.0, < 0.45.4.1 |
| metabase | metabase | >= 0.46.0, < 0.46.6.1 |
| metabase | metabase | >= 1.44.0, < 1.44.7.1 |
| metabase | metabase | >= 1.45.0, < 1.45.4.1 |
| metabase | metabase | >= 1.46.0, < 1.46.6.1 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/174091/Metabase-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Execution.html
- https://github.com/metabase/metabase/issues/32552
- https://github.com/metabase/metabase/releases/tag/v0.46.6.1
- https://news.ycombinator.com/item?id=36812256
- https://www.metabase.com/blog/security-advisory
- http://packetstormsecurity.com/files/174091/Metabase-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Execution.html
- https://github.com/metabase/metabase/issues/32552
- https://github.com/metabase/metabase/releases/tag/v0.46.6.1
- https://news.ycombinator.com/item?id=36812256
- https://www.metabase.com/blog/security-advisory
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2023-38646