PT-2023-19088 · Metabase · Metabase

Nemanjaglumac · Publicado 2023-01-28 · Atualizado 2023-02-06 · CVE-2023-23628

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.43.7.1 Metabase versions prior to 1.43.7.1 Metabase versions prior to 0.44.6.1 Metabase versions prior to 1.44.6.1 Metabase versions prior to 0.45.2.1 Metabase versions prior to 1.45.2.1

Description Metabase is an open source data analytics platform. The issue concerns Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users should not be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription.

Recommendations For versions prior to 0.43.7.1, update to version 0.43.7.1 or later. For versions prior to 1.43.7.1, update to version 1.43.7.1 or later. For versions prior to 0.44.6.1, update to version 0.44.6.1 or later. For versions prior to 1.44.6.1, update to version 1.44.6.1 or later. For versions prior to 0.45.2.1, update to version 0.45.2.1 or later. For versions prior to 1.45.2.1, update to version 1.45.2.1 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-23628

GHSA-492F-QXR3-9RRV

Produtos afetados

Metabase

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23628.json · Exploit
• https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-23628 · Nota de Segurança
• https://t.me/cvenotify/42996 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23628 · Aviso do Fabricante