by Kastro
Paper/Archive/CVE-2023-38646

CVE-2023-38646

mitre — Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server,…

EPSS 99%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.9.999 × 2020.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refmetabase.com/blog/security-advisoryrefgithub.com/metabase/metabase/releases/tag/v0.46.6.1refnews.ycombinator.com/item?id=36812256refgithub.com/metabase/metabase/issues/32552refpacketstormsecurity.com/files/174091/Metabase-Remote-Code-Execution.htmlrefpacketstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Execution.html