cvelistv5 - CVE-2023-23628

CVE-2023-23628 (GCVE-0-2023-23628)

Vulnerability from cvelistv5 – Published: 2023-01-28 01:11 – Updated: 2025-03-10 21:17

Summary

Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.

Severity ?

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

URL

Tags

https://github.com/metabase/metabase/security/adv…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	metabase	metabase	Affected: < 0.43.7.1 Affected: >= 0.44.0-RC1, < 0.44.6.1 Affected: >= 0.45.0-RC1, < 0.45.2.1 Affected: >= 1.0.0, < 1.43.7.1 Affected: >= 1.44.0-RC1, < 1.44.6.1 Affected: >= 1.45.0-RC1, < 1.45.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:35:33.640Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-23628",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T20:58:46.739997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-10T21:17:43.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "metabase",
          "vendor": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.43.7.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.44.0-RC1, \u003c 0.44.6.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.45.0-RC1, \u003c 0.45.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.43.7.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.44.0-RC1, \u003c 1.44.6.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.45.0-RC1, \u003c 1.45.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn\u0027t be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-28T01:11:16.710Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv"
        }
      ],
      "source": {
        "advisory": "GHSA-492f-qxr3-9rrv",
        "discovery": "UNKNOWN"
      },
      "title": "Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor "
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-23628",
    "datePublished": "2023-01-28T01:11:16.710Z",
    "dateReserved": "2023-01-16T17:07:46.244Z",
    "dateUpdated": "2025-03-10T21:17:43.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"0.43.7.1\", \"matchCriteriaId\": \"B739CE77-5465-4018-9A7D-EFE7E2C6912C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"0.44.0\", \"versionEndExcluding\": \"0.44.6.1\", \"matchCriteriaId\": \"DF00E09E-C915-4D5E-BF06-D52E044752C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"0.45.0\", \"versionEndExcluding\": \"0.45.2.1\", \"matchCriteriaId\": \"D4A024C8-A76F-4D31-ACAF-E47E19BC5FE3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.0.0\", \"versionEndExcluding\": \"1.43.7.1\", \"matchCriteriaId\": \"79CF2F09-CA1A-4A02-A529-8E879C011505\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.44.0\", \"versionEndExcluding\": \"1.44.6.1\", \"matchCriteriaId\": \"2A2796BF-3609-4633-9465-671B1A6BDF44\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.45.0\", \"versionEndExcluding\": \"1.45.2.1\", \"matchCriteriaId\": \"79B81DBB-484A-466C-95B3-CD91F7390D31\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn\u0027t be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.\\n\"}, {\"lang\": \"es\", \"value\": \"Metabase es una plataforma de an\\u00e1lisis de datos de c\\u00f3digo abierto. Las versiones afectadas est\\u00e1n sujetas a la exposici\\u00f3n de informaci\\u00f3n confidencial a un actor no autorizado. Los usuarios del espacio aislado no deber\\u00edan poder ver datos sobre otros usuarios de Metabase en ninguna parte de la aplicaci\\u00f3n Metabase. Sin embargo, cuando un usuario del espacio aislado ve la configuraci\\u00f3n de una suscripci\\u00f3n al panel y otro usuario ha agregado usuarios a esa suscripci\\u00f3n, el usuario del espacio aislado puede ver la lista de destinatarios de esa suscripci\\u00f3n. Este problema se solucion\\u00f3 en las versiones 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1 y 1.45.2.1. No hay workarounds.\"}]",
      "id": "CVE-2023-23628",
      "lastModified": "2024-11-21T07:46:34.077",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\", \"baseScore\": 5.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.1, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N\", \"baseScore\": 4.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 1.4}]}",
      "published": "2023-01-28T02:15:07.797",
      "references": "[{\"url\": \"https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-23628\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-01-28T02:15:07.797\",\"lastModified\":\"2024-11-21T07:46:34.077\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn\u0027t be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.\\n\"},{\"lang\":\"es\",\"value\":\"Metabase es una plataforma de an\u00e1lisis de datos de c\u00f3digo abierto. Las versiones afectadas est\u00e1n sujetas a la exposici\u00f3n de informaci\u00f3n confidencial a un actor no autorizado. Los usuarios del espacio aislado no deber\u00edan poder ver datos sobre otros usuarios de Metabase en ninguna parte de la aplicaci\u00f3n Metabase. Sin embargo, cuando un usuario del espacio aislado ve la configuraci\u00f3n de una suscripci\u00f3n al panel y otro usuario ha agregado usuarios a esa suscripci\u00f3n, el usuario del espacio aislado puede ver la lista de destinatarios de esa suscripci\u00f3n. Este problema se solucion\u00f3 en las versiones 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1 y 1.45.2.1. No hay workarounds.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N\",\"baseScore\":4.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.43.7.1\",\"matchCriteriaId\":\"B739CE77-5465-4018-9A7D-EFE7E2C6912C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.44.0\",\"versionEndExcluding\":\"0.44.6.1\",\"matchCriteriaId\":\"DF00E09E-C915-4D5E-BF06-D52E044752C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.45.0\",\"versionEndExcluding\":\"0.45.2.1\",\"matchCriteriaId\":\"D4A024C8-A76F-4D31-ACAF-E47E19BC5FE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0.0\",\"versionEndExcluding\":\"1.43.7.1\",\"matchCriteriaId\":\"79CF2F09-CA1A-4A02-A529-8E879C011505\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.44.0\",\"versionEndExcluding\":\"1.44.6.1\",\"matchCriteriaId\":\"2A2796BF-3609-4633-9465-671B1A6BDF44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.45.0\",\"versionEndExcluding\":\"1.45.2.1\",\"matchCriteriaId\":\"79B81DBB-484A-466C-95B3-CD91F7390D31\"}]}]}],\"references\":[{\"url\":\"https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv\", \"name\": \"https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T10:35:33.640Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-23628\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-10T20:58:46.739997Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-10T20:58:48.523Z\"}}], \"cna\": {\"title\": \"Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor \", \"source\": {\"advisory\": \"GHSA-492f-qxr3-9rrv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"metabase\", \"product\": \"metabase\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.43.7.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 0.44.0-RC1, \u003c 0.44.6.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 0.45.0-RC1, \u003c 0.45.2.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.0.0, \u003c 1.43.7.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.44.0-RC1, \u003c 1.44.6.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.45.0-RC1, \u003c 1.45.2.1\"}]}], \"references\": [{\"url\": \"https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv\", \"name\": \"https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn\u0027t be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.\\n\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-01-28T01:11:16.710Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-23628\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-10T21:17:43.694Z\", \"dateReserved\": \"2023-01-16T17:07:46.244Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-01-28T01:11:16.710Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CNVD-2023-06473

Vulnerability from cnvd - Published: 2023-02-03

Title

Metabase信息泄露漏洞（CNVD-2023-06473）

Description

Metabase是美国Metabase公司的一个开源数据分析平台。 Metabase存在信息泄露漏洞，该漏洞源于将敏感信息暴露给未经授权的用户。目前没有详细的漏洞细节提供。

Severity

中

Patch Name

Metabase信息泄露漏洞（CNVD-2023-06473）的补丁

Patch Description

Metabase是美国Metabase公司的一个开源数据分析平台。 Metabase存在信息泄露漏洞，该漏洞源于将敏感信息暴露给未经授权的用户。目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv

Reference

https://nvd.nist.gov/vuln/detail/CVE-2023-23628

Impacted products

Name
Metabase Metabase

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-23628"
    }
  },
  "description": "Metabase\u662f\u7f8e\u56fdMetabase\u516c\u53f8\u7684\u4e00\u4e2a\u5f00\u6e90\u6570\u636e\u5206\u6790\u5e73\u53f0\u3002\n\nMetabase\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5c06\u654f\u611f\u4fe1\u606f\u66b4\u9732\u7ed9\u672a\u7ecf\u6388\u6743\u7684\u7528\u6237\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-06473",
  "openTime": "2023-02-03",
  "patchDescription": "Metabase\u662f\u7f8e\u56fdMetabase\u516c\u53f8\u7684\u4e00\u4e2a\u5f00\u6e90\u6570\u636e\u5206\u6790\u5e73\u53f0\u3002\r\n\r\nMetabase\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5c06\u654f\u611f\u4fe1\u606f\u66b4\u9732\u7ed9\u672a\u7ecf\u6388\u6743\u7684\u7528\u6237\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Metabase\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2023-06473\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Metabase Metabase"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-23628",
  "serverity": "\u4e2d",
  "submitTime": "2023-01-29",
  "title": "Metabase\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2023-06473\uff09"
}

GSD-2023-23628

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-23628

Aliases

CVE-2023-23628

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-23628",
    "id": "GSD-2023-23628"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-23628"
      ],
      "details": "Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn\u0027t be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.",
      "id": "GSD-2023-23628",
      "modified": "2023-12-13T01:20:49.972293Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-23628",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "metabase",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 0.43.7.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 0.44.0-RC1, \u003c 0.44.6.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 0.45.0-RC1, \u003c 0.45.2.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.0.0, \u003c 1.43.7.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.44.0-RC1, \u003c 1.44.6.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.45.0-RC1, \u003c 1.45.2.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "metabase"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn\u0027t be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-200",
                "lang": "eng",
                "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv",
            "refsource": "MISC",
            "url": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-492f-qxr3-9rrv",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.45.2.1",
                "versionStartIncluding": "1.45.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.44.6.1",
                "versionStartIncluding": "1.44.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.43.7.1",
                "versionStartIncluding": "1.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.45.2.1",
                "versionStartIncluding": "0.45.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.44.6.1",
                "versionStartIncluding": "0.44.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.43.7.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-23628"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn\u0027t be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2023-02-06T19:29Z",
      "publishedDate": "2023-01-28T02:15Z"
    }
  }
}

FKIE_CVE-2023-23628

Vulnerability from fkie_nvd - Published: 2023-01-28 02:15 - Updated: 2024-11-21 07:46

Severity ?

5.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
4.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv	Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv	Third Party Advisory

Impacted products

Vendor	Product	Version
metabase	metabase	*
metabase	metabase	*
metabase	metabase	*
metabase	metabase	*
metabase	metabase	*
metabase	metabase	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B739CE77-5465-4018-9A7D-EFE7E2C6912C",
              "versionEndExcluding": "0.43.7.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF00E09E-C915-4D5E-BF06-D52E044752C5",
              "versionEndExcluding": "0.44.6.1",
              "versionStartIncluding": "0.44.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4A024C8-A76F-4D31-ACAF-E47E19BC5FE3",
              "versionEndExcluding": "0.45.2.1",
              "versionStartIncluding": "0.45.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "79CF2F09-CA1A-4A02-A529-8E879C011505",
              "versionEndExcluding": "1.43.7.1",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A2796BF-3609-4633-9465-671B1A6BDF44",
              "versionEndExcluding": "1.44.6.1",
              "versionStartIncluding": "1.44.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "79B81DBB-484A-466C-95B3-CD91F7390D31",
              "versionEndExcluding": "1.45.2.1",
              "versionStartIncluding": "1.45.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn\u0027t be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.\n"
    },
    {
      "lang": "es",
      "value": "Metabase es una plataforma de an\u00e1lisis de datos de c\u00f3digo abierto. Las versiones afectadas est\u00e1n sujetas a la exposici\u00f3n de informaci\u00f3n confidencial a un actor no autorizado. Los usuarios del espacio aislado no deber\u00edan poder ver datos sobre otros usuarios de Metabase en ninguna parte de la aplicaci\u00f3n Metabase. Sin embargo, cuando un usuario del espacio aislado ve la configuraci\u00f3n de una suscripci\u00f3n al panel y otro usuario ha agregado usuarios a esa suscripci\u00f3n, el usuario del espacio aislado puede ver la lista de destinatarios de esa suscripci\u00f3n. Este problema se solucion\u00f3 en las versiones 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1 y 1.45.2.1. No hay workarounds."
    }
  ],
  "id": "CVE-2023-23628",
  "lastModified": "2024-11-21T07:46:34.077",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-01-28T02:15:07.797",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-23628 (GCVE-0-2023-23628)

CNVD-2023-06473

GSD-2023-23628

FKIE_CVE-2023-23628

Tags

Sightings

Nomenclature