GHSA-pgq7-jcj5-xx6hMediumCVSS 4.3

Apache Druid before 0.23.0 vulnerable to clickjacking

Published
July 8, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-28889 →

📋 Description

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.

🎯 Affected products1

  • maven/org.apache.druid:druid:< 0.23.0

🔗 References (3)