Metabase allows authenticated users to access sensitive database credentials

Summary

Some Metabase users can access database login information, which could be misused. This is fixed in version 0.57.13 and 0.58.7. To protect your database, update to one of these versions or disable email notifications in your Metabase setup.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
metabase	metabase	<= 0.57.13	–
metabase	metabase	<= 1.57.13	–
metabase	metabase	> 0.58.0 , <= 0.58.7	–
metabase	metabase	> 1.58.0 , <= 1.58.7	–

Original title

Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase i...

Original description

Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via template evaluation. This issue has been fixed in versions 0.57.13 and 0.58.7. To workaround this issue, users can disable notifications in their Metabase instance to disallow access to the vulnerable endpoints.

nvd CVSS3.1 6.5

Vulnerability type

CWE-94 Code Injection

CWE-1336

https://github.com/metabase/metabase/releases/tag/v0.57.13 Product Release Notes
https://github.com/metabase/metabase/releases/tag/v0.58.7 Product Release Notes
https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9 Vendor Advisory Patch