Non évaluée
Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When...
CVE-2022-38790
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permission. The exposure appears in Weave GitOps Enterprise UI via a GitopsCluster dashboard link. An annotation can be added to a GitopsCluster custom resource.
Références
- advisory github.com
- advisory nvd.nist.gov
- web docs.gitops.weave.works
- web docs.gitops.weave.works
- web docs.gitops.weave.works
- web weave.works