What is CVE-2023-38646?

CVE-2023-38646 is a critical vulnerability affecting Metabase open source and Metabase Enterprise software. The vulnerability impacts systems running vulnerable versions of Metabase open source and Metabase Enterprise software, posing a significant risk to organizations using these products.

Who is impacted by CVE-2023-38646?

Specifically, it impacts Metabase open source versions before 0.46.6.1 and Metabase Enterprise versions before 1.46.6.1. This security flaw allows attackers to execute commands on the server without needing authentication, posing a risk to those using the affected software versions.

What to do if CVE-2023-38646 affected you

If you're affected by the CVE-2023-38646 vulnerability, it's crucial to take immediate action to protect your systems. Follow these simple steps:

1. Identify if your Metabase open source or Metabase Enterprise software is running a vulnerable version.

2. Update your Metabase installation to the latest fixed version (0.46.6.1 or later for open source, 1.46.6.1 or later for Enterprise).

3. Monitor your systems for any signs of unauthorized access or suspicious activity.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-38646 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This security flaw, also known as Metabase Remote Code Execution, affects Metabase open source and Metabase Enterprise software.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-Insufficient Information, indicating a lack of specific details about the vulnerability and its mitigation.

Learn More

For comprehensive information on this vulnerability, including technical details and mitigation steps, refer to the NVD page and the sources listed below.

• Metasploit

• Musyoka Ian