CVE-2022-38790

Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI

published September 1, 2022

CVSS
—
EPSS
1%
Percentile
56.8
In the wild
Unconfirmed
What it is

Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permission. The exposure appears in Weave GitOps Enterprise UI via a GitopsCluster dashboard link. An annotation can be added to a GitopsCluster custom resource.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00819 · 56.8th percentile
Published
2022-09-01T12:55Z
EPSS history
Timeline
  • 01 SEP 12:55Z
    Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI
    cvelistv5