CVE-2022-36130 Privilege escalation in n/a
Authorized users can escalate privileges across scopes due to missing data integrity checks in HashiCorp Boundary.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-36130?
CVE-2022-36130 is a critical vulnerability in n/a, published on 1 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.
Weakness: CWE-345
Which versions are affected by CVE-2022-36130?
It affects 1 product.
Products include Hashicorp Boundary.
How do I fix CVE-2022-36130?
No fix has been published for CVE-2022-36130 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-36130 being exploited?
There is no known exploitation of CVE-2022-36130 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering
- CVE-2022-36182 Hashicorp Boundary vulnerable to clickjacking
- CVE-2024-12289 Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
- CVE-2023-0690 Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured
Sources
Also known as GHSA-h79m-9724-rw92.