CVE-2023-38646
82Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actepss 99%
de la publicación al arma4 días
Publicada en NVD21 jul
1ª PoC+4d
metasploit+1d
VulnCheck+115d
probabilidad de explotación
99%top 1% de las CVE
explotación observada
síVulnCheck
41 exploit(s) público(s)
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.
Productos afectados
n/a · n/aPoCs públicas encontradas — 41
vulncheckvulncheck.com/xdb/461e16d9704fno verificadovulncheckvulncheck.com/xdb/492f2d2d5985no verificadovulncheckvulncheck.com/xdb/27eaf00f95abno verificadovulncheckvulncheck.com/xdb/9ae7ec2084ffno verificadovulncheckvulncheck.com/xdb/895880cb2bb8no verificadovulncheckvulncheck.com/xdb/5845091d8087no verificadovulncheckvulncheck.com/xdb/70e38f1a0c07no verificadovulncheckvulncheck.com/xdb/3557b45588ecno verificadovulncheckvulncheck.com/xdb/1849a3b32020no verificadovulncheckvulncheck.com/xdb/92a939aaf962no verificadovulncheckvulncheck.com/xdb/6abb430a41afno verificadovulncheckvulncheck.com/xdb/4c19f6e943f9no verificadovulncheckvulncheck.com/xdb/2079f5de74c4no verificadovulncheckvulncheck.com/xdb/7c36b6467c15no verificadovulncheckvulncheck.com/xdb/4a792f6cd8dfno verificadovulncheckvulncheck.com/xdb/96853de4ee42no verificadovulncheckvulncheck.com/xdb/c18953a271a8no verificadovulncheckvulncheck.com/xdb/6db39af8f463no verificadovulncheckvulncheck.com/xdb/dc9e08d93c15no verificadovulncheckvulncheck.com/xdb/12c9d8d9e650no verificadovulncheckvulncheck.com/xdb/5bee07ea42d5no verificadovulncheckvulncheck.com/xdb/21565edd3f61no verificadovulncheckvulncheck.com/xdb/3209042db1feno verificadovulncheckvulncheck.com/xdb/bff992b93263no verificadovulncheckvulncheck.com/xdb/511554125968no verificadovulncheckvulncheck.com/xdb/c4dc991b1cb8no verificadovulncheckvulncheck.com/xdb/dceb47307abano verificadovulncheckvulncheck.com/xdb/b89e2fdc5b49no verificadovulncheckvulncheck.com/xdb/7004633eeb62no verificadovulncheckvulncheck.com/xdb/591b7712bb46no verificadovulncheckvulncheck.com/xdb/b7852cf5d07eno verificadovulncheckvulncheck.com/xdb/f1169a627752no verificadovulncheckvulncheck.com/xdb/f60f3ef848abno verificadovulncheckvulncheck.com/xdb/fc3a7c741130no verificadovulncheckvulncheck.com/xdb/2a6a3d38ef75no verificadovulncheckvulncheck.com/xdb/8e6c4c7b7c59no verificadovulncheckvulncheck.com/xdb/8afd0f9f5843no verificadovulncheckvulncheck.com/xdb/774fcc426fb6no verificadovulncheckvulncheck.com/xdb/cc301ac8ce17no verificadovulncheckvulncheck.com/xdb/fdac192dbc58no verificadovulncheckvulncheck.com/xdb/63ff3e3d1b79no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/174091/Metabase-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Execution.htmlhttps://github.com/metabase/metabase/issues/32552https://github.com/metabase/metabase/releases/tag/v0.46.6.1https://news.ycombinator.com/item?id=36812256https://www.metabase.com/blog/security-advisory