Strix
26.1K

CVE-2023-32680

CRITICALCVSS 9.6/10EPSS 0.60%

Last modified

CVE-2023-32680 is a critical-severity vulnerability rated 9.6/10 on the CVSS scale. Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with native query editing permissions to a database–but affected versions of Metabase didn't enforce that requirement. EPSS estimates a 0.60% chance of exploitation in the next 30 days.

Description

Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with native query editing permissions to a database–but affected versions of Metabase didn't enforce that requirement. This lack of enforcement meant that: Anyone–including people in sandboxed groups–could edit SQL snippets. They could edit snippets via the API or, in the application UI, when editing the metadata for a model based on a SQL question, and people in sandboxed groups could edit a SQL snippet used in a query that creates their sandbox. If the snippet contained logic that restricted which data that person could see, they could potentially edit that snippet and change their level of data access. The permissions model for SQL snippets has been fixed in Metabase versions 0.46.3, 0.45.4, 0.44.7, 1.46.3, 1.45.4, and 1.44.7. Users are advised to upgrade. Users unable to upgrade should ensure that SQL queries used to create sandboxes exclude SQL snippets.

Metrics

CVSS 3.1
9.6/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS Probability
0.60%

44.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
MetabaseMetabase< 0.44.7
MetabaseMetabase>= 0.45.0, < 0.45.4
MetabaseMetabase>= 0.46.0, < 0.46.3
MetabaseMetabase>= 1.0.0, < 1.44.7
MetabaseMetabase>= 1.45.0, < 1.45.4
MetabaseMetabase>= 1.46.0, < 1.46.3

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-32680?
Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with native query editing permissions to a database–but affected versions of Metabase didn't enforce that requirement. This lack of enforcement meant that: Anyone–including people in sandboxed groups–could edit SQL snippets. They could edit snippets via the API or, in the application UI, when editing the metadata for a model based on a SQL question, and people in sandboxed groups could edit a SQL snippet used in a query that creates their sandbox. If the snippet contained logic that restricted which data that person could see, they could potentially edit that snippet and change their level of data access. The permissions model for SQL snippets has been fixed in Metabase versions 0.46.3, 0.45.4, 0.44.7, 1.46.3, 1.45.4, and 1.44.7. Users are advised to upgrade. Users unable to upgrade should ensure that SQL queries used to create sandboxes exclude SQL snippets.
How severe is CVE-2023-32680?
CVE-2023-32680 has a CVSS score of 9.6/10 (CRITICAL severity). The EPSS model estimates a 0.60% probability of exploitation in the next 30 days.
How do I fix CVE-2023-32680?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2023

View all 2023CVEs →

Are you affected by CVE-2023-32680?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST