PT-2023-5110 · H2 +2 · H2 +2

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4 Description: The issue is related to the incorrect management of code generation in the Metabase platform, which could allow remote...

Exploit for CVE-2023-38646

CVE-2023-38646 - Metabase Pre-auth RCE !Untitled presentatio...

Exploit for CVE-2023-38646

CVE-2023...

Exploit for CVE-2023-38646

Poc-Metabase-Preauth-CVE-2023-38646 Ho to use? λ cve git...

Exploit for CVE-2023-38646

Poc-Metabase-Preauth-CVE-2023-38646 Ho to use? λ cve git...

Exploit for CVE-2023-38646

Poc-Metabase-Preauth-CVE-2023-38646 Ho to use? λ cve git...

Exploit for CVE-2023-38646

Metabase Pre Authentication RCE CVE-2023-38646 We have pro...

Exploit for CVE-2023-38646

🛡️ Exploit for CVE-2023-38646 🛡️ Welcome to this powerful exp...

Exploit for CVE-2023-38646

CVE-2023-38646 Metabase Pre-auth R...

Exploit for CVE-2023-38646

For educational purposes only Inspired by Assetnote resea...

Major Security Flaw Discovered in Metabase BI Software – Urgent Update Required

Users of Metabase, a popular business intelligence and data visualization software package, are being advised to update to the latest version following the discovery of an "extremely severe" flaw that could result in pre-authenticated remote code execution on affected installations. Tracked as...

Metabase Setup Token RCE

Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token is accessible even after the setup process has been completed. With this token a user is able to submit the setup functionality to create a new database. When creating a new database, an H2 database string is created wi...

CVE-2023-38646

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...

CVE-2023-38646

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...

Design/Logic Flaw

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...

PT-2023-7075

Name of the Vulnerable Software and Affected Versions Metabase open source versions prior to 0.46.6.1 Metabase Enterprise versions prior to 1.46.6.1 Description The issue allows attackers to execute arbitrary commands on the server at the server's privilege level without requiring authentication...

Metabase 安全漏洞

Metabase is an open source data analytics platform from the US-based Metabase Inc. A security vulnerability exists in Metabase versions prior to 0.46.6.1 and Metabase Enterprise versions prior to 1.46.6.1, which stems from a vulnerability that allows an attacker to execute arbitrary commands on a...

CVE-2023-38646

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...

CVE-2023-38646

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...

CVE-2023-38646

CVE-2023-38646 affects Metabase Open Source versions before 0.46.6.1 and Metabase Enterprise versions before 1.46.6.1, allowing unauthenticated remote code execution via the api/setup/validate endpoint (pre-auth RCE). Exploitation details are documented in multiple PoCs and exploits (e.g., via /a...