Weave
CVE-2024-25545
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
1DescriptionCVE.org
An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component.
AnalysisAI
An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-358. An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component. Affected products include: Weave Weave Desktop.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in
The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. Rated crit
The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. Rated critical severity (CVSS 9.8), thi
Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Rated critical severity
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing K
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS re
Share
External POC / Exploit Code
Leaving vuln.today