VDB

CVE-2023-38646

CVE-2023-38646 PUBLISHED KEV CVSS 9.800000190734863 CRITICAL

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

EPSS 99.48% · 99.9th percentile

Risk Scores

CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
99.48%
99.9th percentile

Affected Products

VendorProductVersions
metabasemetabase0.44.0, 0, 0.45.0
n/an/a*

Timeline

  • CVE Published
  • Jul 22, 2023 EPSS Score
  • Jul 25, 2023 VulnCheck XDB Entry
  • Jul 28, 2023 VulnCheck XDB Entry
  • Jul 28, 2023 Nuclei Template
  • Jul 28, 2023 Fix Commit
  • Jul 29, 2023 VulnCheck XDB Entry
  • Jul 30, 2023 VulnCheck XDB Entry
  • Jul 30, 2023 VulnCheck XDB Entry
  • Jul 31, 2023 VulnCheck XDB Entry
  • Aug 1, 2023 PoC Published
  • Aug 1, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›