Metabase: Multiple vulnerabilities in Pro, Enterprise, and open-source versions

Multiple vulnerabilities have been identified in Metabase. The vendor has released security patches to address these issues, which were disclosed in GHSA-v44v-x8x4-mvcw. The nature of the vulnerabilities remains undisclosed by the manufacturer. Users must upgrade to versions 0.64.3.4 (open-source) or 1.64.3.4 (Pro/Enterprise) to remediate the potential security risk.

Recommendation

• Identify all instances of Metabase in the environment and determine if they are running a version prior to 0.64.3.4 or 1.64.3.4.
• Apply the updates to Metabase, Metabase Pro, and Metabase Enterprise to reach version 0.64.3.4 or 1.64.3.4 immediately.
• Review the vendor's security advisory GHSA-v44v-x8x4-mvcw for any additional post-patch configuration requirements.