CVE-2023-23628 : Security Advisory and Response

This CVE involves Metabase, an open-source data analytics platform, being vulnerable to the Exposure of Sensitive Information to an Unauthorized Actor. It allows sandboxed users to view data about other Metabase users when accessing certain settings, potentially leading to unauthorized access to sensitive information.

Understanding CVE-2023-23628

This section provides an insight into the vulnerability, its impact, technical details, and mitigation strategies.

What is CVE-2023-23628?

CVE-2023-23628 pertains to a security flaw in Metabase where sandboxed users can view data about other users in the application, specifically when accessing dashboard subscription settings. This unauthorized access could lead to the exposure of sensitive information to individuals who should not have access to it.

The Impact of CVE-2023-23628

The impact of this vulnerability is categorized as having a medium severity level with high confidentiality impact. It allows unauthorized users to access information about other users, potentially compromising sensitive data within the Metabase platform.

Technical Details of CVE-2023-23628

This section delves into the vulnerability description, affected systems and versions, as well as the exploitation mechanism.

Vulnerability Description

The flaw in Metabase allows sandboxed users to view information about other users, specifically recipient lists for dashboard subscriptions, breaching data privacy and security protocols.

Affected Systems and Versions

The affected versions of Metabase include:

Versions < 0.43.7.1
Versions >= 0.44.0-RC1, < 0.44.6.1
Versions >= 0.45.0-RC1, < 0.45.2.1
Versions >= 1.0.0, < 1.43.7.1
Versions >= 1.44.0-RC1, < 1.44.6.1
Versions >= 1.45.0-RC1, < 1.45.2.1

Exploitation Mechanism

The vulnerability can be exploited by sandboxed users accessing dashboard subscription settings in Metabase, which inappropriately allows them to view recipient lists meant for other users.

Mitigation and Prevention

To address CVE-2023-23628, it is essential to take immediate steps, establish long-term security practices, and apply necessary patches and updates.

Immediate Steps to Take

Immediately update Metabase to patched versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, or 1.45.2.1 to mitigate the vulnerability and prevent unauthorized access to sensitive information.

Long-Term Security Practices

Implement strict user access controls, regularly monitor for unauthorized activities, and conduct security audits to bolster data privacy and prevent similar vulnerabilities in the future.

Patching and Updates

Regularly check for updates and security advisories from Metabase to ensure that your system is protected against known vulnerabilities. Stay vigilant and proactive in applying patches to maintain a secure data analytics environment.