未評価
Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When...
CVE-2022-38790
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permission. The exposure appears in Weave GitOps Enterprise UI via a GitopsCluster dashboard link. An annotation can be added to a GitopsCluster custom resource.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web docs.gitops.weave.works
- web docs.gitops.weave.works
- web docs.gitops.weave.works
- web weave.works