Vulnerabilities

TI-2024-11399 CVE-2024-12289 · GHSA-xx83-cxmq-x89m

Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service

LOW 27

Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00394 Published 2024-12-12 Fixed in 0.18.2 CWE-460

TI-2024-00973 CVE-2024-1052 · GHSA-vh73-q3rw-qx7w

Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

LOW 37

Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00294 Published 2024-02-05 Fixed in 0.15.0 CWE-295

TI-2023-00652 CVE-2023-0690 · GHSA-9vrm-v9xv-x3xr

Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured

LOW 32

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotatio…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00437 Published 2023-02-08 Fixed in 0.12.0 CWE-312

TI-2022-16583 CVE-2022-36182 · GHSA-xqv2-3vvq-qg6r

Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception…

LOW 28

Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00701 Published 2022-10-27 No fix listed CWE-1021

TI-2022-16552 CVE-2022-36130 · GHSA-h79m-9724-rw92

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure…

MEDIUM 43

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scop…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00482 Published 2022-09-01 No fix listed CWE-345