UpHeron
All vulnerabilities

Servers and applications

CVE-2023-37470

Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, a vulnerability could potentially allow remote code execution on one's Metabase server. The core issue is that one of the supported data warehouses (an embedded in-memory database H2), exposes a number of ways for a…

Severity
Critical 9.8
Published
4 Aug 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, 1.46.6.4
Sources
NVD

Affected software

SoftwareAffected versions
MetabaseServers and applications · cpe:a:metabase:metabase
  • From 1.46.0 before 1.46.6.4
  • From 1.45.0 before 1.45.4.3
  • From 1.44.0 before 1.44.7.3
  • From 0.46.0 before 0.46.6.4
All 8 release lines
  • Every version before 0.43.7.3
  • Every version before 1.43.7.3
  • From 0.44.0 before 0.44.7.3
  • From 0.45.0 before 0.45.4.3
  • From 0.46.0 before 0.46.6.4
  • From 1.44.0 before 1.44.7.3
  • From 1.45.0 before 1.45.4.3
  • From 1.46.0 before 1.46.6.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-37470
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-37470