Vulnerabilities

TI-2023-17072 CVE-2023-34236 · GHSA-6hvv-j432-23cv

Information Disclosure Vulnerability in Weave GitOps Terraform Controller

LOW 39

Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00961 Published 2023-07-14 Fixed in 0.14.4, 0.15.0-rc.5 CWE-200

TI-2022-07568 CVE-2022-23509 · GHSA-89qm-wcmw-3mgg

Weave Gitops Run vulnerable to insecure communication

LOW 34

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise.

CVSS 3.1HIGH 7.4 Adjacent network High privileges User interaction EPSS 0.0025 Published 2023-01-09 Fixed in 0.12.0 CWE-200

TI-2022-07567 CVE-2022-23508 · GHSA-wr3c-g326-486c

GitOps Run allows for Kubernetes workload injection

MEDIUM 40

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise.

CVSS 3.1HIGH 8.9 Adjacent network No auth User interaction EPSS 0.00333 Published 2023-01-09 Fixed in 0.12.0 CWE-284

TI-2022-18289 CVE-2022-38790 · GHSA-69f5-4grj-mqr7

Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a…

LOW 26

Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00837 Published 2022-09-01 No fix listed CWE-79

TI-2022-16401 CVE-2022-35976

Improper KubeConfig handling allows arbitrary code execution

MEDIUM 43

The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00539 Published 2022-08-18 No fix listed CWE-78

TI-2022-16400 CVE-2022-35975

Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode

MEDIUM 46

The GitOps Tools Extension for VSCode can make it easier to manage Flux objects.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01409 Published 2022-08-18 No fix listed CWE-78

TI-2022-13142 CVE-2022-31098 · GHSA-xggc-qprg-x6mw

Weave GitOps leaked cluster credentials into logs on connection errors

MEDIUM 43

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.01261 Published 2022-06-27 Fixed in 0.8.1-rc.6 CWE-532

TI-2020-16099 CVE-2020-26278

Weave Net Pods running in host PID namespace can be used to escalate other Kubernetes vulnerabilities

LOW 36

Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00745 Published 2021-01-20 Fixed in 2.8.0 CWE-250

TI-2020-08965 CVE-2020-11091 · GHSA-59qg-grp7-5r73

Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements

LOW 28

In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service.

CVSS 3.1MEDIUM 5.8 Network High privileges No interaction EPSS 0.0086 Published 2020-06-03 Fixed in 2.6.3 CWE-350

Vulnerabilities

Filters