CVE-2022-28889CWE-1021

Clickjacking in the web console

published July 7, 2022

CVSS
—
EPSS
2%
Percentile
79.2
In the wild
Unconfirmed
What it is

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01872 · 79.2th percentile
Weakness
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames
Published
2022-07-07T18:35Z
EPSS history
Timeline
  • 07 JUL 18:35Z
    Clickjacking in the web console
    cvelistv5