medium4.3
CVE-2022-28889
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking.
Impact
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Druid | before 0.23.0 |