# MA-965.082023: MyCERT Advisory - CVE-2023-38646 - Critical Vulnerability in Metabase Open Source and Enterprise

**Date:** 23 Aug 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-965.082023  
**Advisory ID:** MA-965.082023

---

**1.0 Introduction**
Recently, a new identified vulnerability identified as CVE-2023-38646 enables an unauthenticated attacker to execute arbitrary commands on the Metabase server with the same privileges. This can transform the Metabase server into a potential entry point for further attacks, potentially compromising the integrity of the entire system. The impact of CVE-2023-38646 extends to all aspects of the CIA triad (Confidentiality, Integrity, Availability). While there were no known exploitations at the time of the vulnerability disclosure, a proof-of-concept was released on August 9th, significantly elevating the threat landscape.
**2.0 Impact**
An unauthenticated attacker exploiting this vulnerability could lead to severe data breaches and significant disruptions to business operations. The release of an exploit for this vulnerability amplifies the risks, particularly due to the widespread adoption of Metabase.
**3.0 Affected Products**
The vulnerability affects the following supported versions:
- Metabase open source before 0.46.6.1
- Metabase Enterprise before 1.46.6.1
**4.0 Recommendations**
Metabase has released patches and instructions to address the vulnerability. Immediate upgrading is strongly advised. You can find patches at:
<https://www.metabase.com/blog/security-advisory>
Metabase has provided the following instructions:
For Metabase Enterprise customers, access the latest patched release version at:
- JAR: https://downloads.metabase.com/enterprise/v1.46.7/metabase.jar
- Docker image via metabase/metabase-enterprise:latest or metabase/metabase-enterprise:v1.46.6.1
For open-source Metabase users, access the latest patched release version at:
- JAR: https://downloads.metabase.com/v0.46.7/metabase.jar
- Docker image via metabase/metabase:latest or metabase/metabase:v0.46.6.1
For older versions, patches are available at: https://github.com/metabase/metabase/releases
Given the critical severity, prompt patching is essential, system administrators are urged by MyCERT to apply patches as soon as possible. Additionally, analyze system and network logs for any unusual activity.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. <https://www.metabase.com/blog/security-advisory>
2. <https://cert.be/en/warningexploit-was-released-cve-2023-38646-critical-vulnerability-metabase-open-source-and-metabase>