PT-2022-23248 · Hashicorp · Hashicorp Boundary

Published 2022-10-27 · Updated 2025-05-07 · CVE-2022-36182

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hashicorp Boundary version 0.8.0

Description The issue allows for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site due to Clickjacking.

Recommendations For Hashicorp Boundary version 0.8.0, consider implementing frame busting techniques or other Clickjacking mitigation measures to prevent malicious actions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2022-36182

GHSA-XQV2-3VVQ-QG6R

Affected Products

Hashicorp Boundary

References · 8

• https://osv.dev/vulnerability/GHSA-xqv2-3vvq-qg6r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36182 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36182 · Vendor Advisory
• https://github.com/hashicorp/boundary · Note
• https://t.me/cibsecurity/52150 · Telegram Post
• https://owasp.org/www-community/attacks/Clickjacking · Note
• https://packetstormsecurity.com/files/168654/Hashicorp-Boundary-Clickjacking.html · Note
• https://t.me/cvenotify/121263 · Telegram Post