CVEvulnerability
CVE-2022-36130
9.9 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-09-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-345
Description
HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.
Affected configurations
• hashicorp boundary (< 0.10.2)
Related
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- https://discuss.hashicorp.com Vendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2022017-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorized-users-of-another-scope/43493 Vendor Advisory
- https://discuss.hashicorp.com Vendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2022017-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorized-users-of-another-scope/43493 Vendor Advisory