CVE-2022-23508 — Improper Access Control in Weaveworks Weave-gitops

CWE-284 — Improper Access Control CWE-538 — Insertion of Sensitive Information into Externally-Accessible File or Directory CWE-552 — Files or Directories Accessible to External Parties CWE-200 — Sensitive Information Exposure CWE-319 — Cleartext Transmission of Sensitive Info6 documents3 sources

Severity

7.8HIGHNVD

EPSS

0.1%

top 83.89%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Github.com Weaveworks Weave-gitops Weave Gitops Weaveworks Weave-gitops

Timeline

PublishedJan 9

Latest updateAug 20

Description

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. Its endpoint had no security controls to block unauthorized access, therefore allowing local users (and processes) on the same…