Approved changes feed: RSS · Atom
cpe:2.3:a:cube-js:cube.js:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Cube Js (e6c51fe0-5492-55c2-a5c8-d927787c3707) |
|---|---|
| Product | Cube.Js (76b92368-5358-5a21-a696-3b60e48d96fe) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-23510 |
vulnerable | 2026-06-08 05:40:57.668423 |
SQl injection in cube-js
CRITICAL (9.6)
cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade to 0.31.24 or to downgrade to 0.31.22. There are no known workarounds for this vulnerability.
Published: 2022-12-09T22:12:10.191Z
Updated: 2025-04-23T16:29:13.416Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.