CVE-2023-23628: medium-severity vulnerability in metabase
Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.7epss 0.4%
Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected products
metabase · metabaseRelated CVEs — metabase
In the same product, most dangerous first.
CVE-2021-41277CRITICALGeoJSON URL validation can expose server files and environment variables to unauthorized usersEPSS 97.2%KEVCVE-2026-59827CRITICALMetabase: Unsafe Deserialization of H2 Query ResultsEPSS 3.8%CVE-2022-24853MEDIUMFile system exposure in MetabaseEPSS 2.5%CVE-2023-37470CRITICALMetabase vulnerable to remote code execution via POST /api/setup/validate API endpoint EPSS 1.3%CVE-2022-39361HIGHMetabase vulnerable to Remote Code Execution via H2EPSS 1.3%CVE-2022-24854HIGHDatabase bypassing any permissions in Metabase via SQlite attachEPSS 1.1%