{"id":"CVE-2022-28889","published":"2022-07-07T18:35:22Z","modified":"2024-08-03T06:10:56Z","title":"Clickjacking in the web console","vendor":"Apache","product":"Apache Druid","tier":"tail","description":{"text":"In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01872,"percentile":0.79222,"provenance":"source"},"cwes":[{"id":"CWE-1021","name":"Improper Restriction of Rendered UI Layers or Frames"}],"references":[{"url":"https://lists.apache.org/thread/t3nsq4crdr8wqgmj721d2wg6pf26s5cw","tags":["x_refsource_MISC"]}],"priority":{"score":15.8,"factors":[{"name":"EPSS percentile","points":15.84}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Druid","versions":[">= unspecified, <= 0.22.1"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.druid:druid","vulnerableRanges":["<0.23.0"],"patched":["0.23.0"],"from":["GHSA-pgq7-jcj5-xx6h"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6386","exploited":false,"provenance":"source"}}