Vulnerabilities > CVE-2022-23510 - Unspecified vulnerability in Cube Cube.Js 0.31.23

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
cube
NVD
Published: 2022-12-09
Updated: 2024-11-21

Summary

cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade to 0.31.24 or to downgrade to 0.31.22. There are no known workarounds for this vulnerability.

Vulnerable Configurations

Part Description Count
Application
Cube
1

References