CVE-2023-50709mediumCWE-20

CVE-2023-50709: falha de média gravidade em cube-js cube

Denial of service attack on the cube-api endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar cube.js+ Monitorar @cubejs-backend/api-gateway

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.7%
Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption. There are currently no workaround for older versions, and the recommendation is to upgrade.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
cube-js · cube
CVEs relacionadas — cube-js cube

No mesmo produto, das mais perigosas para as menos.

CVE-2026-25957MEDIUMCube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted requestEPSS 0.4%CVE-2026-25958HIGHCube privilege escalation via a specially crafted requestEPSS 0.4%