CVE-2023-50709

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption. There are currently no workaround for older versions, and the recommendation is to upgrade.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Dec 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-50715.4The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekit_iframe' shortcode in versions up to, and includin CVE-2023-507104.3Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous reque CVE-2023-507119.8vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 CVE-2023-507125.4Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site CVE-2023-507135.0Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in ver CVE-2023-507148.8yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient p CVE-2023-507154.3Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any CVE-2023-507169.8eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Pri CVE-2023-507175.4NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload CVE-2023-507186.5NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could con CVE-2023-507197.5XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based CVE-2023-50727.5Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can le