vendor:
Metabase
by:
Musyoka Ian
8.1
CVSS
CRITICAL
Pre-Auth Remote Code Execution
78
CWE
Product Name: Metabase
Affected Version From: 0.46.6
Affected Version To: 0.46.6
Patch Exists: NO
Related CWE: CVE-2023-38646
CPE: a:metabase:metabase:0.46.6
Platforms Tested: Ubuntu 22.04
2023
metabase 0.46.6 – Pre-Auth Remote Code Execution
The exploit allows an attacker to remotely execute code on the vulnerable server without authentication. This vulnerability has been assigned CVE-2023-38646. An attacker can send a malicious GET request to the '/exploitable' path, leading to the execution of arbitrary code.
Mitigation:
To mitigate this vulnerability, it is recommended to update to a patched version of metabase that addresses this issue.
