gsd - gsd-2023-23629

GSD-2023-23629

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard subscription, add people with fewer data privileges, and all recipients of that subscription receive the same data: the charts shown in the email would abide by the privileges of the user who created the subscription. The issue is users with fewer privileges who can view a dashboard are able to add themselves to a dashboard subscription created by someone with additional data privileges, and thus get access to more data via email. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. On Metabase instances running Enterprise Edition, admins can disable the "Subscriptions and Alerts" permission for groups that have restricted data permissions, as a workaround.

Aliases

CVE-2023-23629

Aliases

CVE-2023-23629

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-23629",
    "id": "GSD-2023-23629"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-23629"
      ],
      "details": "Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard subscription, add people with fewer data privileges, and all recipients of that subscription receive the same data: the charts shown in the email would abide by the privileges of the user who created the subscription. The issue is users with fewer privileges who can view a dashboard are able to add themselves to a dashboard subscription created by someone with additional data privileges, and thus get access to more data via email. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. On Metabase instances running Enterprise Edition, admins can disable the \"Subscriptions and Alerts\" permission for groups that have restricted data permissions, as a workaround.",
      "id": "GSD-2023-23629",
      "modified": "2023-12-13T01:20:49.522452Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-23629",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "metabase",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 0.43.7.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 0.44.0-RC1, \u003c 0.44.6.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 0.45.0-RC1, \u003c 0.45.2.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.0.0, \u003c 1.43.7.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.44.0-RC1, \u003c 1.44.6.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.45.0-RC1, \u003c 1.45.2.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "metabase"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard subscription, add people with fewer data privileges, and all recipients of that subscription receive the same data: the charts shown in the email would abide by the privileges of the user who created the subscription. The issue is users with fewer privileges who can view a dashboard are able to add themselves to a dashboard subscription created by someone with additional data privileges, and thus get access to more data via email. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. On Metabase instances running Enterprise Edition, admins can disable the \"Subscriptions and Alerts\" permission for groups that have restricted data permissions, as a workaround."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-200",
                "lang": "eng",
                "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
              }
            ]
          },
          {
            "description": [
              {
                "cweId": "CWE-269",
                "lang": "eng",
                "value": "CWE-269: Improper Privilege Management"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/metabase/metabase/security/advisories/GHSA-ch8f-hhq9-7gv5",
            "refsource": "MISC",
            "url": "https://github.com/metabase/metabase/security/advisories/GHSA-ch8f-hhq9-7gv5"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-ch8f-hhq9-7gv5",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.45.2.1",
                "versionStartIncluding": "1.45.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.44.6.1",
                "versionStartIncluding": "1.44.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.43.7.1",
                "versionStartIncluding": "1.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.45.2.1",
                "versionStartIncluding": "0.45.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.44.6.1",
                "versionStartIncluding": "0.44.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.43.7.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-23629"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard subscription, add people with fewer data privileges, and all recipients of that subscription receive the same data: the charts shown in the email would abide by the privileges of the user who created the subscription. The issue is users with fewer privileges who can view a dashboard are able to add themselves to a dashboard subscription created by someone with additional data privileges, and thus get access to more data via email. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. On Metabase instances running Enterprise Edition, admins can disable the \"Subscriptions and Alerts\" permission for groups that have restricted data permissions, as a workaround."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-200"
                },
                {
                  "lang": "en",
                  "value": "CWE-269"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/metabase/metabase/security/advisories/GHSA-ch8f-hhq9-7gv5",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/metabase/metabase/security/advisories/GHSA-ch8f-hhq9-7gv5"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.1,
          "impactScore": 4.2
        }
      },
      "lastModifiedDate": "2023-02-07T19:28Z",
      "publishedDate": "2023-01-28T02:15Z"
    }
  }
}

CVE-2023-23629 (GCVE-0-2023-23629)

Vulnerability from cvelistv5 – Published: 2023-01-28 01:23 – Updated: 2025-03-10 21:17

Summary

Severity ?

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-269 - Improper Privilege Management

Assigner

GitHub_M

References

URL

Tags

https://github.com/metabase/metabase/security/adv…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	metabase	metabase	Affected: < 0.43.7.1 Affected: >= 0.44.0-RC1, < 0.44.6.1 Affected: >= 0.45.0-RC1, < 0.45.2.1 Affected: >= 1.0.0, < 1.43.7.1 Affected: >= 1.44.0-RC1, < 1.44.6.1 Affected: >= 1.45.0-RC1, < 1.45.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:35:33.616Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/metabase/metabase/security/advisories/GHSA-ch8f-hhq9-7gv5",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/metabase/metabase/security/advisories/GHSA-ch8f-hhq9-7gv5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-23629",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T20:58:43.915067Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-10T21:17:37.583Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "metabase",
          "vendor": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.43.7.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.44.0-RC1, \u003c 0.44.6.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.45.0-RC1, \u003c 0.45.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.43.7.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.44.0-RC1, \u003c 1.44.6.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.45.0-RC1, \u003c 1.45.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard subscription, add people with fewer data privileges, and all recipients of that subscription receive the same data: the charts shown in the email would abide by the privileges of the user who created the subscription. The issue is users with fewer privileges who can view a dashboard are able to add themselves to a dashboard subscription created by someone with additional data privileges, and thus get access to more data via email. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. On Metabase instances running Enterprise Edition, admins can disable the \"Subscriptions and Alerts\" permission for groups that have restricted data permissions, as a workaround.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-28T01:23:33.300Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/metabase/metabase/security/advisories/GHSA-ch8f-hhq9-7gv5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/metabase/metabase/security/advisories/GHSA-ch8f-hhq9-7gv5"
        }
      ],
      "source": {
        "advisory": "GHSA-ch8f-hhq9-7gv5",
        "discovery": "UNKNOWN"
      },
      "title": "Metabase subject to Improper Privilege Management"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-23629",
    "datePublished": "2023-01-28T01:23:33.300Z",
    "dateReserved": "2023-01-16T17:07:46.245Z",
    "dateUpdated": "2025-03-10T21:17:37.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GSD-2023-23629

CVE-2023-23629 (GCVE-0-2023-23629)

Tags

Sightings

Nomenclature