Lucene search
Veracode Vulnerability DatabaseVERACODE:38450HistoryDec 13, 2022 - 6:00 a.m.
SQL Injection
2022-12-1306:00:37
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
sql injection
api
vulnerability
cubejs-backend
api-gateway
/v1/sql-runner
malicious user
authenticated user
arbitrary sql queries
software
0.001 Low
EPSS
Percentile
50.3%
cubejs-backend/api-gateway is vulnerable to SQL Injection attacks. A specifically crafted attack statement through the /v1/sql-runner endpoint allows a malicious authenticated user to inject and execute arbitrary SQL queries on the target system.
| CPE | Name | Operator | Version |
|---|---|---|---|
| @cubejs-backend/api-gateway | eq | 0.31.23 | |
| @cubejs-backend/api-gateway | eq | 0.31.23 |
Related
osv
osv
@cubejs-backend/api-gateway row level security bypass
2022-12-12 21:28:35
CVE-2022-23510
2022-12-09 23:15:22
github
github
@cubejs-backend/api-gateway row level security bypass
2022-12-12 21:28:35
cve
cve
CVE-2022-23510
2022-12-09 23:15:22
nvd
nvd
CVE-2022-23510
2022-12-09 23:15:22
cvelist
cvelist
CVE-2022-23510 SQl injection in cube-js
2022-12-09 22:12:10
prion
prion
Design/Logic Flaw
2022-12-09 23:15:00