Vulnerabilities > CVE-2022-28889 - Improper Restriction of Rendered UI Layers or Frames vulnerability in Apache Druid

Summary

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.

Vulnerable Configurations

Common Weakness Enumeration (CWE)

• CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

References