Vulnerability in Hashicorp Boundary
CVE-2022-36130
HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (38.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
Weakness classification (CWE)
References
- discuss.hashicorp.com (Vendor Advisory)
- discuss.hashicorp.com/t/hcsec-2022017-boundary-allowed-access-to-host-sets-and-… (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-36130?
- CVE-2022-36130 is a critical-severity vulnerability in Hashicorp Boundary, classified under Insufficient Verification of Data Authenticity. CVSS score: 9.9/10. Published 2022-09-01.
- How severe is CVE-2022-36130?
- Critical severity. CVSS v3 base score is 9.9 out of 10.