CyberRota Analysis
AI-GeneratedMetabase versions from 1.55.0 to 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2 are vulnerable due to insufficient validation of H2 connection properties, enabling authenticated administrators to register malicious H2 database connections that can execute arbitrary Java code on the server. This critical vulnerability poses a significant risk to the integrity and security of the Metabase environment. Organizations using affected versions should prioritize immediate updates to the patched releases to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)