What is CVE-2022-36130?

CVE-2022-36130 is a critical-severity vulnerability in Hashicorp Boundary, classified under Insufficient Verification of Data Authenticity. CVSS score: 9.9/10. Published 2022-09-01.

How severe is CVE-2022-36130?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Vulnerability in Hashicorp Boundary

CVE-2022-36130

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundar…

EPSS: 0.004 (32.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Hashicorp Boundary
N/a — versions n/a

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-36130?: CVE-2022-36130 is a critical-severity vulnerability in Hashicorp Boundary, classified under Insufficient Verification of Data Authenticity. CVSS score: 9.9/10. Published 2022-09-01.
How severe is CVE-2022-36130?: Critical severity. CVSS v3 base score is 9.9 out of 10.