AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

BoundaryGHSA-xqv2-3vvq-qg6r

Hashicorp Boundary vulnerable to clickjacking

Boundary

CVE-2022-36182 · Published Oct 27, 2022 · updated Nov 8, 2023

Medium6.1
No fix yet
GitHub advisory

Hashicorp Boundary is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/boundary
Go
<= 0.11.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-1021
Also known as
CVE-2022-36182

More Boundary advisories

All Boundary
High 7.5May 5Boundary: denial of serviceCVE-2026-7776fixed in 0.19.5 +2Medium 5.9Dec 13, 2024Boundary Community Edition and Boundary EnterpriseCVE-2024-12289fixed in 0.18.2High 8.0Feb 5, 2024Boundary vulnerable to session hijacking through TLS certificate tamperingCVE-2024-1052fixed in 0.15.0High 7.1Jul 6, 2023HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service ConfiguredCVE-2023-0690fixed in 0.12.0