oss-sec mailing list archives

CVE-2022-28889: Apache Druid: Clickjacking in the web console

From: Abhishek Agarwal <abhishek () apache org>
Date: Thu, 07 Jul 2022 16:15:17 +0000

Description:

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 
and later prevent clickjacking using the Content-Security-Policy header.

Mitigation:

Upgrade to Druid 0.23.0 or later.

Current thread:

CVE-2022-28889: Apache Druid: Clickjacking in the web console Abhishek Agarwal (Jul 07)