Behoben in
CVEs, die 0.44 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2023-38646 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitr... | 9.8 | — | 2023-07-21 | |
| CVE-2023-37470 | Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint | 9.8 | — | 2023-08-04 | |
| CVE-2023-32680 | Missing SQL permissions check in metabase | 9.6 | — | 2023-05-18 | |
| CVE-2022-39362 | Metabase vulnerable to arbitrary SQL execution from queryhash | 8.8 | — | 2022-10-26 | |
| CVE-2022-39361 | Metabase vulnerable to Remote Code Execution via H2 | 8.8 | — | 2022-10-26 | |
| CVE-2026-33725 | Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import | 7.2 | — | 2026-03-27 | |
| CVE-2026-92813 | Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass | 6.9 | — | 2026-09-17 | |
| CVE-2022-39360 | Metabase SSO users able to circumvent IdP login by doing password reset | 6.5 | — | 2022-10-26 | |
| CVE-2022-43776 | The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side R... | 6.5 | — | 2022-10-26 | |
| CVE-2022-39359 | Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs | 6.5 | — | 2022-10-26 | |
| CVE-2022-39358 | Metabase vulnerable to circumvention of Locked parameter in Signed Embedding | 6.5 | — | 2022-10-26 | |
| CVE-2026-27464 | Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE | 6.5 | — | 2026-02-21 | |
| CVE-2023-23629 | Metabase subject to Improper Privilege Management | 6.3 | — | 2023-01-28 | |
| CVE-2023-23628 | Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor | 4.1 | — | 2023-01-28 | |
| CVE-2026-22805 | Metabase channel test endpoint can reach internal local addresses | 2.1 | — | 2026-01-12 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).