CVE report
CVE-2023-38646critical
Metabase < 0.46.6.1 - Remote Code Execution
Events 90d
262
Distinct IPs
118
Severity
critical
CISA KEV
Not listed
Detection signature
An event counts toward CVE-2023-38646 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /api/setup/validate
- · /api/session/properties
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 23 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2023-38646
- 124.198.131.18521 eventsUnited States· 1337 Services GmbH
- 66.154.119.22417 eventsUnited States· CYBERCON, INC.
- 185.242.3.56 eventsThe Netherlands· Netiface America, Inc.
- 45.156.128.1085 eventsPortugal
- 185.226.197.684 eventsPortugal
- 45.156.128.1064 eventsPortugal
- 109.105.209.174 eventsPortugal
- 45.156.129.1624 eventsPortugal
- 45.156.129.1284 eventsPortugal
- 109.105.210.834 eventsPortugal
- 45.156.129.1614 eventsPortugal
- 45.156.128.1114 eventsPortugal
- 45.156.129.1554 eventsPortugal
- 109.105.209.183 eventsPortugal
- 45.156.128.1073 eventsPortugal
- 45.156.129.1543 eventsPortugal
- 45.156.129.1693 eventsPortugal
- 109.105.210.893 eventsPortugal
- 185.226.197.623 eventsPortugal
- 45.156.129.1173 eventsPortugal
- 185.226.198.53 eventsPortugal· Sistemas Informaticos, S.A.
- 109.105.209.193 eventsPortugal
- 45.156.129.1103 eventsPortugal
- 185.180.141.543 eventsPortugal
- 45.156.128.1703 eventsPortugal
- 185.226.196.273 eventsPortugal
- 185.226.198.43 eventsPortugal· Sistemas Informaticos, S.A.
- 185.226.197.643 eventsPortugal
- 185.226.196.283 eventsPortugal
- 45.156.128.1513 eventsPortugal
Top networks the attempts come from
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
Sample request paths observed
- /api/session/properties