{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-11T15:37:09.037","vulnerabilities":[{"cve":{"id":"CVE-2022-23510","sourceIdentifier":"security-advisories@github.com","published":"2022-12-09T23:15:22.227","lastModified":"2024-11-21T06:48:42.890","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade to 0.31.24 or to downgrade to 0.31.22. There are no known workarounds for this vulnerability."},{"lang":"es","value":"cube-js es una plataforma de inteligencia empresarial headless. En la versión 0.31.23, todos los clientes Cube autenticados podían eludir la seguridad de nivel de fila de SQL y ejecutar SQL arbitrario a través del endpoint /v1/sql-runner recientemente introducido. Este problema se resolvió en la versión 0.31.24. Se recomienda a los usuarios actualizar a 0.31.24 o bajar a 0.31.22. No se conocen workarounds para esta vulnerabilidad."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cube:cube.js:0.31.23:*:*:*:*:node.js:*:*","matchCriteriaId":"DE64AB39-926F-4408-807E-86F1E6C917FC"}]}]}],"references":[{"url":"https://github.com/cube-js/cube.js/commit/3c614674fed6ca17df08bbba8c835ef110167570","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/cube-js/cube.js/commit/f1140de508e359970ac82b50bae1c4bf152f6041","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/cube-js/cube.js/security/advisories/GHSA-6jqm-3c9g-pch7","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/cube-js/cube.js/commit/3c614674fed6ca17df08bbba8c835ef110167570","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/cube-js/cube.js/commit/f1140de508e359970ac82b50bae1c4bf152f6041","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/cube-js/cube.js/security/advisories/GHSA-6jqm-3c9g-pch7","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}