« Volver al listado

CVE-2023-23628

Estado: ModificadaMedia (4.1)—

Metabase es una plataforma de análisis de datos de código abierto. Las versiones afectadas están sujetas a la exposición de información confidencial a un actor no autorizado. Los usuarios del espacio aislado no deberían poder ver datos sobre otros usuarios de Metabase en ninguna parte de la aplicación Metabase. Sin embargo, cuando un usuario del espacio aislado ve la configuración de una suscripción al panel y otro usuario ha agregado usuarios a esa suscripción, el usuario del espacio aislado puede ver la lista de destinatarios de esa suscripción. Este problema se solucionó en las versiones 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1 y 1.45.2.1. No hay workarounds.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Metabase — Metabase

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-23628",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-23628",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-10T20:58:46.739997Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "metabase",
          "product": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.43.7.1"
            },
            {
              "status": "affected",
              "version": ">= 0.44.0-RC1, < 0.44.6.1"
            },
            {
              "status": "affected",
              "version": ">= 0.45.0-RC1, < 0.45.2.1"
            },
            {
              "status": "affected",
              "version": ">= 1.0.0, < 1.43.7.1"
            },
            {
              "status": "affected",
              "version": ">= 1.44.0-RC1, < 1.44.6.1"
            },
            {
              "status": "affected",
              "version": ">= 1.45.0-RC1, < 1.45.2.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-01-28T02:15:07.797",
  "references": [
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.\n"
    },
    {
      "lang": "es",
      "value": "Metabase es una plataforma de análisis de datos de código abierto. Las versiones afectadas están sujetas a la exposición de información confidencial a un actor no autorizado. Los usuarios del espacio aislado no deberían poder ver datos sobre otros usuarios de Metabase en ninguna parte de la aplicación Metabase. Sin embargo, cuando un usuario del espacio aislado ve la configuración de una suscripción al panel y otro usuario ha agregado usuarios a esa suscripción, el usuario del espacio aislado puede ver la lista de destinatarios de esa suscripción. Este problema se solucionó en las versiones 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1 y 1.45.2.1. No hay workarounds."
    }
  ],
  "lastModified": "2026-06-17T05:37:37.277",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B739CE77-5465-4018-9A7D-EFE7E2C6912C",
              "versionEndExcluding": "0.43.7.1"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF00E09E-C915-4D5E-BF06-D52E044752C5",
              "versionEndExcluding": "0.44.6.1",
              "versionStartIncluding": "0.44.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4A024C8-A76F-4D31-ACAF-E47E19BC5FE3",
              "versionEndExcluding": "0.45.2.1",
              "versionStartIncluding": "0.45.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79CF2F09-CA1A-4A02-A529-8E879C011505",
              "versionEndExcluding": "1.43.7.1",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A2796BF-3609-4633-9465-671B1A6BDF44",
              "versionEndExcluding": "1.44.6.1",
              "versionStartIncluding": "1.44.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79B81DBB-484A-466C-95B3-CD91F7390D31",
              "versionEndExcluding": "1.45.2.1",
              "versionStartIncluding": "1.45.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}