cube vulnerabilities
2 known vulnerabilities in cube from Cube-js. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
2vulnerabilities
0critical
2high
0exploited
7.6average CVSS score
Latest first
- 7.7 High severity
cube: Reliance on Untrusted Inputs in a Security Decision
Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.
- 7.5 High severity
Cube is a semantic layer for building data applications.
Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recomm