CVE-2023-50709 Denial of service attack on the cube-api endpoint

2023-12-1322:00:04

CWE-20

GitHub_M

www.cve.org

cve-2023-50709

cube api

denial of service

endpoint

upgrade

service disruption

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.0005 Low

EPSS

Percentile

17.1%

JSON

Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in v0.34.34 and it’s recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption.
There are currently no workaround for older versions, and the recommendation is to upgrade.

CNA Affected

[
  {
    "vendor": "cube-js",
    "product": "cube",
    "versions": [
      {
        "version": "< 0.34.34",
        "status": "affected"
      }
    ]
  }
]