CVE-2022-36130

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.

Score

CVSS 3.1 9.9 Critical

Status

Modified - cve@mitre.org

Published

2022-09-01

Last modified

2024-08-03

Weaknesses

CWE-345

Affected products

• Boundary (Hashicorp)

References

• https://discuss.hashicorp.com
• https://discuss.hashicorp.com/t/hcsec-2022017-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorize…