CVE-2023-38646
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
Metabase versions before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server at the server's privilege level. Exploitation does not require authentication.
Risk Assessment
This vulnerability poses a serious risk to organizations, allowing attackers full control over the server. It may lead to data loss and compromise of system integrity.
Recommendation
It is recommended to upgrade Metabase to version 0.46.6.1 or 1.46.6.1, or to other listed versions to mitigate the risk associated with this vulnerability.
Original NVD description (English source)
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.