Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permission. The exposure appears in Weave GitOps Enterprise UI via a GitopsCluster dashboard link. An annotation can be added to a GitopsCluster custom resource.
References
| Link | Resource |
|---|---|
| https://docs.gitops.weave.works/docs/cluster-management/getting-started/#profiles-and-clusters | Product Vendor Advisory |
| https://docs.gitops.weave.works/docs/intro | Product Vendor Advisory |
| https://docs.gitops.weave.works/security/cve/enterprise/CVE-2022-38790/index.html | Exploit Patch Vendor Advisory |
| https://www.weave.works/product/gitops-enterprise/ | Product Vendor Advisory |
| https://docs.gitops.weave.works/docs/cluster-management/getting-started/#profiles-and-clusters | Product Vendor Advisory |
| https://docs.gitops.weave.works/docs/intro | Product Vendor Advisory |
| https://docs.gitops.weave.works/security/cve/enterprise/CVE-2022-38790/index.html | Exploit Patch Vendor Advisory |
| https://www.weave.works/product/gitops-enterprise/ | Product Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://docs.gitops.weave.works/docs/cluster-management/getting-started/#profiles-and-clusters - Product, Vendor Advisory | |
| References | () https://docs.gitops.weave.works/docs/intro - Product, Vendor Advisory | |
| References | () https://docs.gitops.weave.works/security/cve/enterprise/CVE-2022-38790/index.html - Exploit, Patch, Vendor Advisory | |
| References | () https://www.weave.works/product/gitops-enterprise/ - Product, Vendor Advisory |
07 Sep 2022, 17:06
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:weave.works:gitops:0.9.0:rc1:*:*:enterprise:*:*:* cpe:2.3:a:weave.works:gitops:*:*:*:*:enterprise:*:*:* cpe:2.3:a:weave.works:gitops:0.9.0:rc3:*:*:enterprise:*:*:* cpe:2.3:a:weave.works:gitops:0.9.0:rc2:*:*:enterprise:*:*:* |
|
| CWE | CWE-79 | |
| References | (MISC) https://docs.gitops.weave.works/docs/intro - Product, Vendor Advisory | |
| References | (MISC) https://docs.gitops.weave.works/security/cve/enterprise/CVE-2022-38790/index.html - Exploit, Patch, Vendor Advisory | |
| References | (MISC) https://www.weave.works/product/gitops-enterprise/ - Product, Vendor Advisory | |
| References | (MISC) https://docs.gitops.weave.works/docs/cluster-management/getting-started/#profiles-and-clusters - Product, Vendor Advisory |
01 Sep 2022, 17:47
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-09-01 13:15
Updated : 2024-11-21 07:17
NVD link : CVE-2022-38790
Mitre link : CVE-2022-38790
CVE.ORG link : CVE-2022-38790
JSON object : View
Products Affected
weave.works
- gitops
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')