Skip to content
OpenAdvisories

Package · Go

github.com/argoproj/argo-cd/v2

48 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

48 results · Feed

  • Medium 6.5
    CVE-2022-31016

    Argo CD vulnerable to Uncontrolled Memory Consumption

    Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Critical 10.0
    CVE-2022-29165

    Argo CD will blindly trust JWT claims if anonymous access is enabled

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated users to impersonate…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Medium 4.3
    CVE-2022-24905

    Argo CD login screen allows message spoofing if SSO is enabled

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled.…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Medium 4.3
    CVE-2022-24904

    Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to lea…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Medium 6.8
    CVE-2022-24731

    Path traversal allows leaking out-of-bound files from Argo CD repo-server

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to lea…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • High 7.7
    CVE-2022-24730

    Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a maliciou…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • High 7.7
    CVE-2022-24348 Public exploit

    Path traversal and dereference of symlinks in Argo CD

    Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.

    github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Medium 4.7
    CVE-2021-23347

    Cross-site Scripting (XSS)

    The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.

    github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go