Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, a vulnerability could potentially allow remote code execution on one's Metabase server. The core iss
Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, a vulnerability could potentially allow remote code execution on one's Metabase server. The core issue is that one of the supported data warehouses (an embedded in-memory database H2), exposes a number of ways for a…
| Vendor | Product | Versions |
|---|---|---|
| metabase | metabase | < 0.43.7.3, >= 0.44.0.0, < 0.44.7.3, >= 0.45.0.0, < 0.45.4.3, >= 0.46.0.0, < 0.46.6.4, >= 1.0.0, < 1.43.7.3, >= 1.44.0.0, < 1.44.7.3, >= 1.45.0.0, < 1.45.4.3, >= 1.46.0.0, < 1.46.6.4 |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.