by Kastro
Paper/Archive/CVE-2022-36130

CVE-2022-36130

mitre — HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct s…

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
38
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 41.6.416 × 208.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

refdiscuss.hashicorp.comrefdiscuss.hashicorp.com/t/hcsec-2022017-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorized-users-of-another-scope/43493