GHSA-xqv2-3vvq-qg6r

Hashicorp Boundary vulnerable to clickjacking

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-36182

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/boundary	<= 0.11.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Hashicorp Boundary is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-36182 advisory
https://github.com/hashicorp/boundary package
https://owasp.org/www-community/attacks/Clickjacking web
https://packetstormsecurity.com/files/168654/Hashicorp-Boundary-Clickjacking.html web