CVE-2023-37470

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>metabase</name>
	<range><lt>0.43.7.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Metabase is an open-source business intelligence and analytics
	platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4,
	1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, a vulnerability could
	potentially allow remote code execution on one's Metabase server. The
	core issue is that one of the supported data warehouses (an embedded
	in-memory database H2), exposes a number of ways for a connection
	string to include code that is then executed by the process running
	the embedded database. Because Metabase allows users to connect to
	databases, this means that a user supplied string can be used to
	inject executable code. Metabase allows users to validate their
	connection string before adding a database (including on setup), and
	this validation API was the primary vector used as it can be called
	without validation. Versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4,
	1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4 fix this issue by removing
	the ability of users to add H2 databases entirely. As a workaround, it
	is possible to block these vulnerabilities at the network level by
	blocking the endpoints `POST /api/database`, `PUT /api/database/:id`,
	and `POST /api/setup/validateuntil`. Those who use H2 as a file-based
	database should migrate to SQLite.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2023-37470</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2023-37470</url>
    </references>
    <dates>
      <discovery>2023-08-04</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>