CVE-2023-50709CWE-20

Denial of service attack on the cube-api endpoint

Medium · published December 13, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption.

There are currently no workaround for older versions, and the recommendation is to upgrade.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00722 · 53.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-12-13T22:00Z
EPSS history
Timeline
  • 13 DEC 22:00Z
    Denial of service attack on the cube-api endpoint
    cvelistv5