PT-2022-4593 · Weave · Weave Gitops Enterprise

Published 2022-09-01 · Updated 2022-09-07 · CVE-2022-38790

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Weave GitOps Enterprise versions prior to 0.9.0-rc.5

Description The issue is related to a lack of input data sanitization, which can be exploited by a remote attacker to conduct a cross-site scripting (XSS) attack using a specially crafted link. This allows a malicious user to inject a javascript: link in the UI, and when clicked by a victim user, the script will execute with the victim's permission. The exposure appears in the Weave GitOps Enterprise UI via a GitopsCluster dashboard link, where an annotation can be added to a GitopsCluster custom resource.

Recommendations For Weave GitOps Enterprise versions prior to 0.9.0-rc.5, update to version 0.9.0-rc.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the GitopsCluster dashboard link to minimize the risk of exploitation. Avoid adding annotations to GitopsCluster custom resources from untrusted sources until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-05470

CVE-2022-38790

Affected Products

Weave Gitops Enterprise

References · 8

• 🔥 https://docs.gitops.weave.works/security/cve/enterprise/CVE-2022-38790/index.html · Exploit
• https://docs.gitops.weave.works/docs/cluster-management/getting-started/#profiles-and-clusters · Vendor Advisory
• https://docs.gitops.weave.works/docs/intro · Vendor Advisory
• https://weave.works/product/gitops-enterprise · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38790 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05470 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38790 · Security Note
• https://t.me/cibsecurity/49160 · Telegram Post