CVE-2022-38790

MEDIUM 5.4CVE-2022-38790 · Published 01/09/2022 · updated 17/06/2026

In short

CVE-2022-38790 is a MEDIUM (CVSS 5.4) vulnerability affecting gitops (weave.works).
Chance of exploitation in the next 30 days (EPSS): 0.84%, higher than 58.0% of all vulnerabilities.
Fix: update to 0.9.0 or later.

Package	Affected versions	Patched versions
gitops weave.works	`= 0.9.0< 0.9.0`	`0.9.0`

Description

Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permission. The exposure appears in Weave GitOps Enterprise UI via a GitopsCluster dashboard link. An annotation can be added to a GitopsCluster custom resource.

References

docs.gitops.weave.works/docs/cluster-management/getting-started · Product
docs.gitops.weave.works/docs/intro · Product
docs.gitops.weave.works/security/cve/enterprise/CVE-2022-38790/index.html · Exploit
weave.works/product/gitops-enterprise · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free