GitHub_MCVELIST:CVE-2022-35975CVE-2022-35975 Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode
9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
9.9 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
75.7%
The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that are shared amongst other users are affected by this issue. The only safe mitigation is to update to the latest version of the extension.
CNA Affected
[
{
"product": "vscode-gitops-tools",
"vendor": "weaveworks",
"versions": [
{
"status": "affected",
"version": ">= 0.7.0, <= 0.20.2"
}
]
}
]Related
9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
9.9 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
75.7%