Skip to content
Fencer Vulns
high 7.4

CVE-2022-23509 json

Weave Gitops Run vulnerable to insecure communication

published 2023-01-09 3 y ago modified 2026-06-17 4 mo ago also GHSA-89qm-wcmw-3mgg , GO-2023-1388 , EUVD-2023-0403

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. The communication between GitOps Run and the local S3 bucket is not encrypted. This allows privileged users or process to tap the local traffic to gain information permitting access to the s3 bucket. From that point, it would be possible to alter the bucket content, resulting in changes in the Kubernetes cluster's resources. There are no known workaround(s) for this vulnerability. This vulnerability has been fixed by commits ce2bbff and babd915. Users should upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022.

Patch / fix

  • go github.com/weaveworks/weave-gitops 0.12.0
  • weave weave_gitops 0.12.0

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
19 mo ago

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 7.3 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/weaveworks/weave-gitops
<0.12.0
0.12.0

Affected products

  • weaveworks weave-gitops

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-319 Cleartext Transmission of Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.