CVE-2022-36130

Published: Sep 1, 2022Modified: Jun 17, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: NVD

Description

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.

Affected (1)

Products: Hashicorp: Boundary

Hashicorp

1 product

Boundary

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Boundary	Before 0.10.2

Related CWEs

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (4)

https://discuss.hashicorp.com

Source: cve@mitre.org

Vendor Advisory

https://discuss.hashicorp.com/t/hcsec-2022017-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorized-users-of-another-scope/43493

Source: cve@mitre.org

Vendor Advisory

https://discuss.hashicorp.com

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://discuss.hashicorp.com/t/hcsec-2022017-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorized-users-of-another-scope/43493

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.