-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) The S3 server endpoint lacked authentication middleware (added via AuthMiddleware in 966823b), and 2) Static credentials enabled predictable access. The main function in cmd/gitops-bucket-server/main.go was vulnerable because it exposed the S3 server without access controls. createBucketAndSecretObjects in setup_bucket_source.go compounded the issue by using hardcoded credentials. Both are directly addressed in the patches: AuthMiddleware enforces signature verification, and credential generation functions replace static values.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/weaveworks/weave-gitops | go | <= 0.11.0 | 0.12.0 |
GoGoOngoing coverage of React2Shell