CVE-2022-28889

CVE-2022-28889: Clickjacking in the web console

Vendor Apache Software Foundation

Product Apache Druid

Weakness CWE-1021

Published July 7, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.

Key dates

02Disclosure timeline

July 7, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-28889 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1021.html

Related vulnerabilities

04Related CVE

CVE-2022-2965 Improper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserp CVE-2026-26000 XWiki Platform affected by click-jacking through CSS injection in comments CVE-2026-21785 HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy CVE-2026-2378 Address bar spoofing risk in ArcSearch on Android CVE-2025-43854 DIFY vulnerable to Clickjacking Attack