Weaveworks vulnerabilities
We track 4 vulnerabilities in Weaveworks products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on January 9, 2023.
Latest Weaveworks vulnerabilities
- 7.8 High severity
weave-gitops: Files or Directories Accessible to External Parties
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps run
- 9.8 Critical severity
vscode-gitops-tools: Improper Neutralization of Special Elements used in an OS Command
The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generated
- 9.8 Critical severity
vscode-gitops-tools: Improper Neutralization of Special Elements used in an OS Command
The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode
- 7.5 High severity
weave-gitops: Insertion of Sensitive Information into Log File
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster c