CVE-2022-28889

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Druid	>= unspecified, <= 0.22.1

References

https://lists.apache.org/thread/t3nsq4crdr8wqgmj721d2wg6pf26s5cwMailing List, Vendor Advisory
https://lists.apache.org/thread/t3nsq4crdr8wqgmj721d2wg6pf26s5cwMailing List, Vendor Advisory

Timeline

Published: Jul 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-28897.8Use After Free in GitHub repository vim/vim prior to 9.0.0225.CVE-2022-288909.8A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache CVE-2022-288928.8Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens ar CVE-2022-288937.8The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.CVE-2022-288959.8A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allows attackers to esca CVE-2022-288969.8A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 allows attackers to esc CVE-2022-28905.4Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-289019.8A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate CVE-2022-289059.8TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setD CVE-2022-289069.8TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLa CVE-2022-289079.8TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyn CVE-2022-289089.8TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDi