PT-2022-23074 · Unknown · Gitops Tools Extension For Vscode

Pjbgf · Published 2022-08-18 · Updated 2022-08-22 · CVE-2022-35975

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitOps Tools Extension for VSCode (affected versions not specified)

Description A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that are shared amongst other users are affected by this issue.

Recommendations Update to the latest version of the GitOps Tools Extension for VSCode.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-35975

GHSA-873X-829R-GXCP

Affected Products

Gitops Tools Extension For Vscode

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35975.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35975 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35975 · Vendor Advisory
• https://github.com/weaveworks/vscode-gitops-tools/security/advisories/GHSA-873x-829r-gxcp · Note
• https://t.me/cibsecurity/48371 · Telegram Post