Vulnerability in Weaveworks Weave
CVE-2020-11091
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IP…
EPSS: 0.002 (37.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N.
Affected products
- Weaveworks Weave — versions < 2.6.3
Weakness classification (CWE)
References
- github.com/weaveworks/weave/security/advisories/GHSA-59qg-grp7-5r73 (x_refsource_CONFIRM)
- github.com/weaveworks/weave/commit/15f21f1899060f7716c70a8555a084e836f39a60 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-11091?
- CVE-2020-11091 is a medium-severity vulnerability in Weaveworks Weave, classified under CWE-350. CVSS score: 5.8/10. Published 2020-06-03.
- How severe is CVE-2020-11091?
- Medium severity. CVSS v3 base score is 5.8 out of 10.