Unrated
Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When...
CVE-2022-38790
First seen on SecPulse
Original description The description as published by the source.
Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permission. The exposure appears in Weave GitOps Enterprise UI via a GitopsCluster dashboard link. An annotation can be added to a GitopsCluster custom resource.
References
- advisory github.com
- advisory nvd.nist.gov
- web docs.gitops.weave.works
- web docs.gitops.weave.works
- web docs.gitops.weave.works
- web weave.works