by Kastro
Paper/Archive/CVE-2022-23510

CVE-2022-23510

cube-js cube.js — SQl injection in cube-js

EPSS 1.0%CVSS 9.6
critical.is priorityof 100
41
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 62.1.621 × 2012.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade to 0.31.24 or to downgrade to 0.31.22. There are no known workarounds for this vulnerability.

Affected

ProductAffectedFixed inSource
cube.js= 0.31.23–CNA

Scores by source

GitHub_M (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/cube-js/cube.js/security/advisories/GHSA-6jqm-3c9g-pch7refgithub.com/cube-js/cube.js/commit/3c614674fed6ca17df08bbba8c835ef110167570refgithub.com/cube-js/cube.js/commit/f1140de508e359970ac82b50bae1c4bf152f6041